Get a list of audit logs generated by Microsoft Entra ID.

  • Least privileged Microsoft Graph permission to access the action via application: AuditLog.Read.All, Directory.Read.All.

External Documentation

To learn more, visit the Microsoft Entra ID documentation.

​
Parameters

ParameterDescription
FilterSpecify a query to filter the results.

For example: activityDisplayName eq 'GroupLifecyclePolicies_Get'.

For more information, please visit Microsoft’s documentation.
LimitSet the page size of the returned results.
Order ByDefine the attribute to sort the returned items by, along with the sort direction (asc/desc).

For example: activityDateTime asc.
Skip TokenA cursor for the next page of results. This value can be obtained from a previous response, in the @odata.nextLink field.

Important: You must use the same parameter values in the next request as in the previous one when using a skip token.

For more information, please visit Microsoft’s documentation.

​
Example Output

{
	"@odata.context": "https://graph.microsoft.com/v1.0/$metadata#auditlogs/directoryaudits",
	"value": [
		{
			"id": "id",
			"category": "UserManagement",
			"correlationId": "da159bfb-54fa-4092-8a38-6e1fa7870e30",
			"result": "success",
			"resultReason": "Successfully added member to group",
			"activityDisplayName": "Add member to group",
			"activityDateTime": "2018-01-09T21:20:02.7215374Z",
			"loggedByService": "Core Directory",
			"initiatedBy": {
				"user": {
					"id": "728309ae-1a37-4937-9afe-e35d964db09b",
					"displayName": "Audry Oliver",
					"userPrincipalName": "bob@wingtiptoysonline.com",
					"ipAddress": "127.0.0.1"
				},
				"app": null
			},
			"targetResources": [
				{
					"id": "ef7e527d-6c92-4234-8c6d-cf6fdfb57f95",
					"displayName": "Example.com",
					"Type": "Group",
					"modifiedProperties": [
						{
							"displayName": "Action Client Name",
							"oldValue": null,
							"newValue": "DirectorySync"
						}
					],
					"groupType": "unifiedGroups"
				},
				{
					"id": "1f0e98f5-3161-4c6b-9b50-d488572f2bb7",
					"displayName": null,
					"Type": "User",
					"modifiedProperties": [],
					"userPrincipalName": "bob@contoso.com"
				}
			],
			"additionalDetails": [
				{
					"key": "Additional Detail Name",
					"value": "Additional Detail Value"
				}
			]
		}
	]
}

​
Workflow Library Example

List Directory Audits with Microsoft Entra Id and Send Results Via Email

Preview this Workflow on desktop