directoryAudit resource type
Namespace: microsoft.graph
Represents the directory audit items and its collection.
Methods
| Method | Return Type | Description |
|---|---|---|
| List | directoryAudit | List the directory audit items in the collection and their properties. |
| Get | directoryAudit | Get a specific directory audit item and its properties. |
Properties
| Property | Type | Description |
|---|---|---|
| activityDateTime | DateTimeOffset | Indicates the date and time the activity was performed. The Timestamp type is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Supports $filter (eq, ge, le) and $orderby. |
| activityDisplayName | String | Indicates the activity name or the operation name (examples: "Create User" and "Add member to group"). For a list of activities logged, refer to Microsoft Entra audit log categories and activities. Supports $filter (eq, startswith). |
| additionalDetails | keyValue collection | Indicates additional details on the activity. |
| category | String | Indicates which resource category that's targeted by the activity. For example: UserManagement, GroupManagement, ApplicationManagement, RoleManagement. For a list of categories for activities logged, refer to Microsoft Entra audit log categories and activities. |
| correlationId | Guid | Indicates a unique ID that helps correlate activities that span across various services. Can be used to trace logs across services. Supports $filter (eq). |
| id | String | Indicates the unique ID for the activity. This is a GUID. Supports $filter (eq). |
| initiatedBy | auditActivityInitiator | Indicates information about the user or app initiated the activity. Supports $filter (eq) for user/id, user/displayName, user/userPrincipalName, app/appId, app/displayName; and $filter (startswith) for user/userPrincipalName. |
| loggedByService | String | Indicates information on which service initiated the activity (For example: Self-service Password Management, Core Directory, B2C, Invited Users, Microsoft Identity Manager, Privileged Identity Management. Supports $filter (eq). |
| operationType | String | Indicates the type of operation that was performed. The possible values include but are not limited to the following: Add, Assign, Update, Unassign, and Delete. |
| result | operationResult | Indicates the result of the activity. Possible values are: success, failure, timeout, unknownFutureValue. |
| resultReason | String | Indicates the reason for failure if the result is failure or timeout. |
| targetResources | targetResource collection | Indicates information on which resource was changed due to the activity. Target Resource Type can be User, Device, Directory, App, Role, Group, Policy or Other. Supports $filter (eq) for id and displayName; and $filter (startswith) for displayName. |
Relationships
None
JSON representation
The following JSON representation shows the resource type.
{
"activityDateTime": "String (timestamp)",
"activityDisplayName": "String",
"additionalDetails": [{"@odata.type": "microsoft.graph.keyValue"}],
"category": "String",
"correlationId": "Guid",
"id": "String (identifier)",
"initiatedBy": {"@odata.type": "microsoft.graph.auditActivityInitiator"},
"loggedByService": "String",
"operationType": "String",
"result": "String",
"resultReason": "String",
"targetResources": [{"@odata.type": "microsoft.graph.targetResource"}]
}