This group tracks the creation modification or deletion of server principles which include logins and server roles.
LOGbinder for SQL Server events generated under this Audit Action Group: