@llafortezza you're correct that the numeric field name is what's causing the issue here. You should be able to escape the field name in order to allow EQL to parse it correctly:
sequence by `azure.auditlogs.properties.target_resources.0.id` with maxspan=24h
[any where event.dataset == "azure.auditlogs" and event.outcome in ("Success", "success") and event.action == "Add user"]
[any where event.dataset == "azure.auditlogs" and event.outcome in ("Success", "success") and event.action == "Delete user"]