List Directory Audits - BlinkOps Documentation

Get a list of audit logs generated by Microsoft Entra ID.

Least privileged Microsoft Graph permission to access the action via application: AuditLog.Read.All, Directory.Read.All.

External DocumentationTo learn more, visit the Microsoft Entra ID documentation.

Parameters

Parameter	Description
Filter	Specify a query to filter the results. For example: `activityDisplayName eq 'GroupLifecyclePolicies_Get'`. For more information, please visit Microsoft’s documentation.
Limit	Set the page size of the returned results.
Order By	Define the attribute to sort the returned items by, along with the sort direction (asc/desc). For example: `activityDateTime asc`.
Return All Pages	Automatically fetch all resources, page by page.
Skip Token	A cursor for the next page of results. This value can be obtained from a previous response, in the `@odata.nextLink` field. Important: You must use the same parameter values in the next request as in the previous one when using a skip token. For more information, please visit Microsoft’s documentation.

Example Output

{
	"@odata.context": "https://graph.microsoft.com/v1.0/$metadata#auditlogs/directoryaudits",
	"value": [
		{
			"id": "id",
			"category": "UserManagement",
			"correlationId": "da159bfb-54fa-4092-8a38-6e1fa7870e30",
			"result": "success",
			"resultReason": "Successfully added member to group",
			"activityDisplayName": "Add member to group",
			"activityDateTime": "2018-01-09T21:20:02.7215374Z",
			"loggedByService": "Core Directory",
			"initiatedBy": {
				"user": {
					"id": "728309ae-1a37-4937-9afe-e35d964db09b",
					"displayName": "Audry Oliver",
					"userPrincipalName": "bob@wingtiptoysonline.com",
					"ipAddress": "127.0.0.1"
				},
				"app": null
			},
			"targetResources": [
				{
					"id": "ef7e527d-6c92-4234-8c6d-cf6fdfb57f95",
					"displayName": "Example.com",
					"Type": "Group",
					"modifiedProperties": [
						{
							"displayName": "Action Client Name",
							"oldValue": null,
							"newValue": "DirectorySync"
						}
					],
					"groupType": "unifiedGroups"
				},
				{
					"id": "1f0e98f5-3161-4c6b-9b50-d488572f2bb7",
					"displayName": null,
					"Type": "User",
					"modifiedProperties": [],
					"userPrincipalName": "bob@contoso.com"
				}
			],
			"additionalDetails": [
				{
					"key": "Additional Detail Name",
					"value": "Additional Detail Value"
				}
			]
		}
	]
}

Workflow Library Example

List Directory Audits with Microsoft Entra Id and Send Results Via Email

Preview this Workflow on desktop