New Audit Log - BlinkOps Documentation

Triggers a workflow on every new audit log.

Least privileged Microsoft Graph permission to utilize the trigger via application: AuditLog.Read.All, Directory.Read.All.

Endpoint: https://graph.microsoft.com/v1.0/auditLogs/directoryaudits

Workflows with this trigger check for new events every 5 minutes by default. You can adjust this interval in the Trigger settings.

Parameters

Parameter	Description
Filter	Specify a query to filter the results. For example: `activityDisplayName eq 'GroupLifecyclePolicies_Get'`. Important Note: Using `activityDateTime` attribute in your filter query is NOT allowed.

Sample Event

{
	"id": "SSGM_b662f17a-4e4d-4e1c-9248-cdec180024b2_MCDC4_88453290",
	"category": "GroupManagement",
	"correlationId": "b662f17a-4e4d-4e1c-9248-cdec180024b2",
	"result": "success",
	"resultReason": "OK",
	"activityDisplayName": "GroupLifecyclePolicies_Get",
	"activityDateTime": "2024-12-27T10:01:19.5796748Z",
	"loggedByService": "Self-service Group Management",
	"operationType": "Update",
	"initiatedBy": {
		"app": null,
		"user": {
			"id": "00000000-0000-0000-0000-000000000000",
			"displayName": null,
			"userPrincipalName": null,
			"ipAddress": "10.0.0.0",
			"userType": null,
			"homeTenantId": null,
			"homeTenantName": null
		}
	},
	"targetResources": [
		{
			"id": "00000000-0000-0000-0000-000000000000",
			"displayName": null,
			"type": "N/A",
			"userPrincipalName": null,
			"groupType": null,
			"modifiedProperties": []
		}
	],
	"additionalDetails": []
}

New Alert New User

⌘I

​Parameters

​Sample Event

Parameters

Sample Event