I am currently processing access level requests for my team, in relation to elevating and restricting access levels via the users tab. (All Requests come to myself)

When checking the audit logs, I am seeing the following details:

• Authentication Mechanism: S2S_ServicePrincipal
• UserAgent: VSServices (w3wp.exe) (Service=licenseprodukus)
• Agent Displayname: Azure DevOps Service

I am enquiring is this something actioned by a user in Visual Studio? Or a possible postman API run?

Trying to establish who and what is changing the licensing when the team should be coming to a single source?

just my details in the audit log for licensing