The Audit shows that the Storage Account performed an action and not which user.

I often find that the AODocs audit says that a Storage Account performs an action and not a user.

This is often confusing when we are trying to investigate who moved a folder.
Is there anyway we can find out which used started an action?