Triggers a workflow on every new audit log.

  • Least privileged Microsoft Graph permission to utilize the trigger via application: AuditLog.Read.All, Directory.Read.All.

Workflows based on this trigger will search for new events every 5 minutes.

​
Parameters

ParameterDescription
FilterSpecify a query to filter the results.

For example: activityDisplayName eq 'GroupLifecyclePolicies_Get'.

Important Note: Using activityDateTime attribute in your filter query is NOT allowed.

​
Sample Event

{
	"id": "SSGM_b662f17a-4e4d-4e1c-9248-cdec180024b2_MCDC4_88453290",
	"category": "GroupManagement",
	"correlationId": "b662f17a-4e4d-4e1c-9248-cdec180024b2",
	"result": "success",
	"resultReason": "OK",
	"activityDisplayName": "GroupLifecyclePolicies_Get",
	"activityDateTime": "2024-12-27T10:01:19.5796748Z",
	"loggedByService": "Self-service Group Management",
	"operationType": "Update",
	"initiatedBy": {
		"app": null,
		"user": {
			"id": "00000000-0000-0000-0000-000000000000",
			"displayName": null,
			"userPrincipalName": null,
			"ipAddress": "10.0.0.0",
			"userType": null,
			"homeTenantId": null,
			"homeTenantName": null
		}
	},
	"targetResources": [
		{
			"id": "00000000-0000-0000-0000-000000000000",
			"displayName": null,
			"type": "N/A",
			"userPrincipalName": null,
			"groupType": null,
			"modifiedProperties": []
		}
	],
	"additionalDetails": []
}