Loading table information…

Structured examples

Contribute a synthetic example using PowerShell or an export from the hunting portal. Contributions are reviewed before publication.

These examples use synthetic values and cover only some possible event variants. Use them as a reference, never as ground truth or a complete schema. Fields can vary between events; a field shown here is not necessarily required.

Category LoggedByService OperationName

`AdditionalDetails`

Submit an example

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Add service principal

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "AppId",
    "value": "00000000-0000-4000-8000-000000000001"
  },
  {
    "key": "AppOwnerOrganizationId",
    "value": "00000000-0000-4000-8000-000000000002"
  },
  {
    "key": "ServicePrincipalProvisioningType",
    "value": "VALUE_2"
  },
  {
    "key": "User-Agent",
    "value": "VALUE_1"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=AppId]`	named-property
`$[][key=AppOwnerOrganizationId]`	named-property
`$[][key=ServicePrincipalProvisioningType]`	named-property
`$[][key=User-Agent]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Update service principal

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "AppId",
    "value": "00000000-0000-4000-8000-000000000001"
  },
  {
    "key": "AppOwnerOrganizationId",
    "value": "00000000-0000-4000-8000-000000000002"
  },
  {
    "key": "ServicePrincipalProvisioningType",
    "value": "VALUE_2"
  },
  {
    "key": "User-Agent",
    "value": "VALUE_1"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=AppId]`	named-property
`$[][key=AppOwnerOrganizationId]`	named-property
`$[][key=ServicePrincipalProvisioningType]`	named-property
`$[][key=User-Agent]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: Device · LoggedByService: Core Directory · OperationName: Update device

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "DeviceId",
    "value": "00000000-0000-4000-8000-000000000001"
  },
  {
    "key": "DeviceOSType",
    "value": "VALUE_1"
  },
  {
    "key": "DeviceTrustType",
    "value": "VALUE_2"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=DeviceId]`	named-property
`$[][key=DeviceOSType]`	named-property
`$[][key=DeviceTrustType]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Remove service principal credentials

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "AppId",
    "value": "00000000-0000-4000-8000-000000000001"
  },
  {
    "key": "ServicePrincipalProvisioningType",
    "value": "VALUE_1"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=AppId]`	named-property
`$[][key=ServicePrincipalProvisioningType]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ProvisioningManagement · LoggedByService: Account Provisioning · OperationName: Import

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "Details",
    "value": "VALUE_1"
  },
  {
    "key": "ErrorCode",
    "value": "VALUE_1"
  },
  {
    "key": "EventName",
    "value": "VALUE_2"
  },
  {
    "key": "JoiningProperty",
    "value": "VALUE_3"
  },
  {
    "key": "RequestId",
    "value": "00000000-0000-4000-8000-000000000002"
  },
  {
    "key": "SourceAnchor",
    "value": "00000000-0000-4000-8000-000000000001"
  },
  {
    "key": "TargetAnchor",
    "value": "VALUE_1"
  },
  {
    "key": "ipaddr",
    "value": "VALUE_1"
  },
  {
    "key": "oid",
    "value": "VALUE_1"
  },
  {
    "key": "tid",
    "value": "VALUE_1"
  },
  {
    "key": "wids",
    "value": "VALUE_1"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=Details]`	named-property
`$[][key=ErrorCode]`	named-property
`$[][key=EventName]`	named-property
`$[][key=JoiningProperty]`	named-property
`$[][key=RequestId]`	named-property
`$[][key=SourceAnchor]`	named-property
`$[][key=TargetAnchor]`	named-property
`$[][key=ipaddr]`	named-property
`$[][key=oid]`	named-property
`$[][key=tid]`	named-property
`$[][key=wids]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Remove service principal

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "AppId",
    "value": "00000000-0000-4000-8000-000000000001"
  },
  {
    "key": "ServicePrincipalProvisioningType",
    "value": "VALUE_1"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=AppId]`	named-property
`$[][key=ServicePrincipalProvisioningType]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ProvisioningManagement · LoggedByService: Account Provisioning · OperationName: Execution

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "Details",
    "value": "VALUE_1"
  },
  {
    "key": "ErrorCode",
    "value": "VALUE_2"
  },
  {
    "key": "EventName",
    "value": "VALUE_3"
  },
  {
    "key": "JoiningProperty",
    "value": "VALUE_2"
  },
  {
    "key": "RequestId",
    "value": "00000000-0000-4000-8000-000000000001"
  },
  {
    "key": "SourceAnchor",
    "value": "VALUE_2"
  },
  {
    "key": "TargetAnchor",
    "value": "VALUE_2"
  },
  {
    "key": "ipaddr",
    "value": "VALUE_2"
  },
  {
    "key": "oid",
    "value": "VALUE_2"
  },
  {
    "key": "tid",
    "value": "VALUE_2"
  },
  {
    "key": "wids",
    "value": "VALUE_2"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=Details]`	named-property
`$[][key=ErrorCode]`	named-property
`$[][key=EventName]`	named-property
`$[][key=JoiningProperty]`	named-property
`$[][key=RequestId]`	named-property
`$[][key=SourceAnchor]`	named-property
`$[][key=TargetAnchor]`	named-property
`$[][key=ipaddr]`	named-property
`$[][key=oid]`	named-property
`$[][key=tid]`	named-property
`$[][key=wids]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Update service principal

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "AppId",
    "value": "00000000-0000-4000-8000-000000000001"
  },
  {
    "key": "ServicePrincipalProvisioningType",
    "value": "VALUE_1"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=AppId]`	named-property
`$[][key=ServicePrincipalProvisioningType]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Consent to application

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "AppId",
    "value": "00000000-0000-4000-8000-000000000001"
  },
  {
    "key": "AppOwnerOrganizationId",
    "value": "00000000-0000-4000-8000-000000000002"
  },
  {
    "key": "ServicePrincipalProvisioningType",
    "value": "VALUE_2"
  },
  {
    "key": "User-Agent",
    "value": "VALUE_1"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=AppId]`	named-property
`$[][key=AppOwnerOrganizationId]`	named-property
`$[][key=ServicePrincipalProvisioningType]`	named-property
`$[][key=User-Agent]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Add delegated permission grant

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "AppId",
    "value": "00000000-0000-4000-8000-000000000001"
  },
  {
    "key": "ServicePrincipalProvisioningType",
    "value": "VALUE_2"
  },
  {
    "key": "User-Agent",
    "value": "VALUE_1"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=AppId]`	named-property
`$[][key=ServicePrincipalProvisioningType]`	named-property
`$[][key=User-Agent]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Consent to application

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "AppId",
    "value": "00000000-0000-4000-8000-000000000001"
  },
  {
    "key": "ServicePrincipalProvisioningType",
    "value": "VALUE_2"
  },
  {
    "key": "User-Agent",
    "value": "VALUE_1"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=AppId]`	named-property
`$[][key=ServicePrincipalProvisioningType]`	named-property
`$[][key=User-Agent]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Add service principal credentials

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "AppId",
    "value": "00000000-0000-4000-8000-000000000001"
  },
  {
    "key": "AppOwnerOrganizationId",
    "value": "00000000-0000-4000-8000-000000000002"
  },
  {
    "key": "ServicePrincipalProvisioningType",
    "value": "VALUE_1"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=AppId]`	named-property
`$[][key=AppOwnerOrganizationId]`	named-property
`$[][key=ServicePrincipalProvisioningType]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: UserManagement · LoggedByService: Core Directory · OperationName: Update user

All values in this example are synthetic. Format: JSON; column encoding: native-json.

[
  {
    "Name": "UserAgent",
    "Value": "VALUE_1"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].Name`	string
`$[].Value`	string
`$[][Name=UserAgent]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: Device · LoggedByService: Core Directory · OperationName: Update device

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "DeviceId",
    "value": "00000000-0000-4000-8000-000000000001"
  },
  {
    "key": "DeviceOSType",
    "value": "VALUE_1"
  },
  {
    "key": "DeviceTrustType",
    "value": "VALUE_2"
  },
  {
    "key": "User-Agent",
    "value": "VALUE_3"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=DeviceId]`	named-property
`$[][key=DeviceOSType]`	named-property
`$[][key=DeviceTrustType]`	named-property
`$[][key=User-Agent]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Remove service principal credentials

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "AppId",
    "value": "00000000-0000-4000-8000-000000000001"
  },
  {
    "key": "AppOwnerOrganizationId",
    "value": "00000000-0000-4000-8000-000000000002"
  },
  {
    "key": "ServicePrincipalProvisioningType",
    "value": "VALUE_1"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=AppId]`	named-property
`$[][key=AppOwnerOrganizationId]`	named-property
`$[][key=ServicePrincipalProvisioningType]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: GroupManagement · LoggedByService: Self-service Group Management · OperationName: Settings_GetSettingsAsync

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "RequestId",
    "value": "00000000-0000-4000-8000-000000000001"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=RequestId]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Update application

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "AppId",
    "value": "00000000-0000-4000-8000-000000000001"
  },
  {
    "key": "User-Agent",
    "value": "VALUE_1"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=AppId]`	named-property
`$[][key=User-Agent]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: UserManagement · LoggedByService: Core Directory · OperationName: Update user

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "UserType",
    "value": "VALUE_1"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=UserType]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Add app role assignment to service principal

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "AppId",
    "value": "00000000-0000-4000-8000-000000000001"
  },
  {
    "key": "ServicePrincipalProvisioningType",
    "value": "VALUE_2"
  },
  {
    "key": "User-Agent",
    "value": "VALUE_1"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=AppId]`	named-property
`$[][key=ServicePrincipalProvisioningType]`	named-property
`$[][key=User-Agent]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: RoleManagement · LoggedByService: Core Directory · OperationName: Add member to role

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[]

Payload fields and types

Path	Type
`$`	array

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ProvisioningManagement · LoggedByService: Account Provisioning · OperationName: Synchronization rule action

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "Details",
    "value": "VALUE_1"
  },
  {
    "key": "ErrorCode",
    "value": "VALUE_1"
  },
  {
    "key": "EventName",
    "value": "VALUE_2"
  },
  {
    "key": "JoiningProperty",
    "value": "00000000-0000-4000-8000-000000000001"
  },
  {
    "key": "RequestId",
    "value": "00000000-0000-4000-8000-000000000002"
  },
  {
    "key": "SourceAnchor",
    "value": "00000000-0000-4000-8000-000000000001"
  },
  {
    "key": "TargetAnchor",
    "value": "VALUE_1"
  },
  {
    "key": "ipaddr",
    "value": "VALUE_1"
  },
  {
    "key": "oid",
    "value": "VALUE_1"
  },
  {
    "key": "tid",
    "value": "VALUE_1"
  },
  {
    "key": "wids",
    "value": "VALUE_1"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=Details]`	named-property
`$[][key=ErrorCode]`	named-property
`$[][key=EventName]`	named-property
`$[][key=JoiningProperty]`	named-property
`$[][key=RequestId]`	named-property
`$[][key=SourceAnchor]`	named-property
`$[][key=TargetAnchor]`	named-property
`$[][key=ipaddr]`	named-property
`$[][key=oid]`	named-property
`$[][key=tid]`	named-property
`$[][key=wids]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: GroupManagement · LoggedByService: Self-service Group Management · OperationName: Group_GetDynamicGroupProperties

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "RequestId",
    "value": "00000000-0000-4000-8000-000000000001"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=RequestId]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Add service principal

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "AppId",
    "value": "00000000-0000-4000-8000-000000000001"
  },
  {
    "key": "AppOwnerOrganizationId",
    "value": "00000000-0000-4000-8000-000000000002"
  },
  {
    "key": "ServicePrincipalProvisioningType",
    "value": "VALUE_1"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=AppId]`	named-property
`$[][key=AppOwnerOrganizationId]`	named-property
`$[][key=ServicePrincipalProvisioningType]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Create application – Certificates and secrets management

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "AppId",
    "value": "00000000-0000-4000-8000-000000000001"
  },
  {
    "key": "User-Agent",
    "value": "VALUE_1"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=AppId]`	named-property
`$[][key=User-Agent]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Add service principal

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "AppId",
    "value": "00000000-0000-4000-8000-000000000001"
  },
  {
    "key": "ServicePrincipalProvisioningType",
    "value": "VALUE_1"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=AppId]`	named-property
`$[][key=ServicePrincipalProvisioningType]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Add application

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "AppId",
    "value": "00000000-0000-4000-8000-000000000001"
  },
  {
    "key": "User-Agent",
    "value": "VALUE_1"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=AppId]`	named-property
`$[][key=User-Agent]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: Authentication · LoggedByService: B2C · OperationName: Validate user authentication

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "RequestId",
    "value": "00000000-0000-4000-8000-000000000002"
  },
  {
    "key": "actorIdentityType",
    "value": "VALUE_2"
  },
  {
    "key": "targetEntityType",
    "value": "VALUE_1"
  },
  {
    "key": "targetTenant",
    "value": "00000000-0000-4000-8000-000000000001"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=RequestId]`	named-property
`$[][key=actorIdentityType]`	named-property
`$[][key=targetEntityType]`	named-property
`$[][key=targetTenant]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Update application

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "AppId",
    "value": "00000000-0000-4000-8000-000000000001"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=AppId]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: GroupManagement · LoggedByService: Self-service Group Management · OperationName: GroupsODataV4_Get

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "RequestId",
    "value": "00000000-0000-4000-8000-000000000001"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=RequestId]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: UserManagement · LoggedByService: Core Directory · OperationName: Update user

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "User-Agent",
    "value": "VALUE_2"
  },
  {
    "key": "UserType",
    "value": "VALUE_1"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=User-Agent]`	named-property
`$[][key=UserType]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ProvisioningManagement · LoggedByService: Account Provisioning · OperationName: Other

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "Details",
    "value": "VALUE_1"
  },
  {
    "key": "ErrorCode",
    "value": "VALUE_1"
  },
  {
    "key": "EventName",
    "value": "VALUE_2"
  },
  {
    "key": "JoiningProperty",
    "value": "VALUE_3"
  },
  {
    "key": "RequestId",
    "value": "00000000-0000-4000-8000-000000000001"
  },
  {
    "key": "SourceAnchor",
    "value": "VALUE_1"
  },
  {
    "key": "TargetAnchor",
    "value": "VALUE_1"
  },
  {
    "key": "ipaddr",
    "value": "VALUE_1"
  },
  {
    "key": "oid",
    "value": "VALUE_1"
  },
  {
    "key": "tid",
    "value": "VALUE_1"
  },
  {
    "key": "wids",
    "value": "VALUE_1"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=Details]`	named-property
`$[][key=ErrorCode]`	named-property
`$[][key=EventName]`	named-property
`$[][key=JoiningProperty]`	named-property
`$[][key=RequestId]`	named-property
`$[][key=SourceAnchor]`	named-property
`$[][key=TargetAnchor]`	named-property
`$[][key=ipaddr]`	named-property
`$[][key=oid]`	named-property
`$[][key=tid]`	named-property
`$[][key=wids]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Add service principal credentials

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "AppId",
    "value": "00000000-0000-4000-8000-000000000001"
  },
  {
    "key": "ServicePrincipalProvisioningType",
    "value": "VALUE_1"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=AppId]`	named-property
`$[][key=ServicePrincipalProvisioningType]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: UserManagement · LoggedByService: Core Directory · OperationName: Add app role assignment grant to user

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "AppId",
    "value": "00000000-0000-4000-8000-000000000001"
  },
  {
    "key": "ServicePrincipalProvisioningType",
    "value": "VALUE_2"
  },
  {
    "key": "User-Agent",
    "value": "VALUE_1"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=AppId]`	named-property
`$[][key=ServicePrincipalProvisioningType]`	named-property
`$[][key=User-Agent]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: GroupManagement · LoggedByService: Self-service Group Management · OperationName: GroupLifecyclePolicies_Get

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "key": "RequestId",
    "value": "00000000-0000-4000-8000-000000000001"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].key`	string
`$[].value`	string
`$[][key=RequestId]`	named-property

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

`InitiatedBy`

Submit an example

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Remove service principal

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "app": {
    "agentType": "VALUE_1",
    "appId": null,
    "blueprintId": null,
    "displayName": "USERNAME_1",
    "servicePrincipalId": "00000000-0000-4000-8000-000000000001",
    "servicePrincipalName": null
  }
}

Payload fields and types

Path	Type
`$`	object
`$.app`	object
`$.app.agentType`	string
`$.app.appId`	null
`$.app.blueprintId`	null
`$.app.displayName`	string
`$.app.servicePrincipalId`	string
`$.app.servicePrincipalName`	null

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Consent to application

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "user": {
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "ipAddress": "192.0.2.1",
    "roles": [],
    "userPrincipalName": "USERNAME_1@example.invalid"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.user`	object
`$.user.agentType`	string
`$.user.displayName`	string
`$.user.id`	string
`$.user.ipAddress`	string
`$.user.roles`	array
`$.user.userPrincipalName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Update service principal

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "app": {
    "agentType": "VALUE_1",
    "appId": null,
    "blueprintId": null,
    "displayName": "USERNAME_1",
    "servicePrincipalId": "00000000-0000-4000-8000-000000000001",
    "servicePrincipalName": null
  }
}

Payload fields and types

Path	Type
`$`	object
`$.app`	object
`$.app.agentType`	string
`$.app.appId`	null
`$.app.blueprintId`	null
`$.app.displayName`	string
`$.app.servicePrincipalId`	string
`$.app.servicePrincipalName`	null

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Add service principal credentials

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "app": {
    "agentType": "VALUE_1",
    "appId": null,
    "blueprintId": null,
    "displayName": "USERNAME_1",
    "servicePrincipalId": "00000000-0000-4000-8000-000000000001",
    "servicePrincipalName": null
  }
}

Payload fields and types

Path	Type
`$`	object
`$.app`	object
`$.app.agentType`	string
`$.app.appId`	null
`$.app.blueprintId`	null
`$.app.displayName`	string
`$.app.servicePrincipalId`	string
`$.app.servicePrincipalName`	null

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: GroupManagement · LoggedByService: Self-service Group Management · OperationName: GroupsODataV4_Get

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "app": {
    "agentType": "VALUE_1",
    "appId": null,
    "blueprintId": null,
    "displayName": "USERNAME_1@example.invalid",
    "servicePrincipalId": null,
    "servicePrincipalName": null
  }
}

Payload fields and types

Path	Type
`$`	object
`$.app`	object
`$.app.agentType`	string
`$.app.appId`	null
`$.app.blueprintId`	null
`$.app.displayName`	string
`$.app.servicePrincipalId`	null
`$.app.servicePrincipalName`	null

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: UserManagement · LoggedByService: Core Directory · OperationName: Update user

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "app": {
    "agentType": "VALUE_1",
    "appId": null,
    "blueprintId": null,
    "displayName": "USERNAME_1",
    "servicePrincipalId": "00000000-0000-4000-8000-000000000001",
    "servicePrincipalName": null
  }
}

Payload fields and types

Path	Type
`$`	object
`$.app`	object
`$.app.agentType`	string
`$.app.appId`	null
`$.app.blueprintId`	null
`$.app.displayName`	string
`$.app.servicePrincipalId`	string
`$.app.servicePrincipalName`	null

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Remove service principal credentials

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "app": {
    "agentType": "VALUE_1",
    "appId": null,
    "blueprintId": null,
    "displayName": "USERNAME_1",
    "servicePrincipalId": "00000000-0000-4000-8000-000000000001",
    "servicePrincipalName": null
  }
}

Payload fields and types

Path	Type
`$`	object
`$.app`	object
`$.app.agentType`	string
`$.app.appId`	null
`$.app.blueprintId`	null
`$.app.displayName`	string
`$.app.servicePrincipalId`	string
`$.app.servicePrincipalName`	null

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: UserManagement · LoggedByService: Core Directory · OperationName: Add app role assignment grant to user

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "user": {
    "agentType": "VALUE_1",
    "displayName": null,
    "id": "00000000-0000-4000-8000-000000000001",
    "ipAddress": "192.0.2.1",
    "roles": [],
    "userPrincipalName": "USERNAME_1@example.invalid"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.user`	object
`$.user.agentType`	string
`$.user.displayName`	null
`$.user.id`	string
`$.user.ipAddress`	string
`$.user.roles`	array
`$.user.userPrincipalName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: GroupManagement · LoggedByService: Self-service Group Management · OperationName: Group_GetDynamicGroupProperties

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "app": {
    "agentType": "VALUE_1",
    "appId": null,
    "blueprintId": null,
    "displayName": "USERNAME_1@example.invalid",
    "servicePrincipalId": null,
    "servicePrincipalName": null
  }
}

Payload fields and types

Path	Type
`$`	object
`$.app`	object
`$.app.agentType`	string
`$.app.appId`	null
`$.app.blueprintId`	null
`$.app.displayName`	string
`$.app.servicePrincipalId`	null
`$.app.servicePrincipalName`	null

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Add application

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "user": {
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "ipAddress": "192.0.2.1",
    "roles": [],
    "userPrincipalName": "USERNAME_1@example.invalid"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.user`	object
`$.user.agentType`	string
`$.user.displayName`	string
`$.user.id`	string
`$.user.ipAddress`	string
`$.user.roles`	array
`$.user.userPrincipalName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: Device · LoggedByService: Core Directory · OperationName: Update device

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "app": {
    "agentType": "VALUE_1",
    "appId": null,
    "blueprintId": null,
    "displayName": "USERNAME_1",
    "servicePrincipalId": "00000000-0000-4000-8000-000000000001",
    "servicePrincipalName": null
  }
}

Payload fields and types

Path	Type
`$`	object
`$.app`	object
`$.app.agentType`	string
`$.app.appId`	null
`$.app.blueprintId`	null
`$.app.displayName`	string
`$.app.servicePrincipalId`	string
`$.app.servicePrincipalName`	null

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Create application – Certificates and secrets management

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "user": {
    "agentType": "VALUE_1",
    "displayName": null,
    "id": "00000000-0000-4000-8000-000000000001",
    "ipAddress": "192.0.2.1",
    "roles": [],
    "userPrincipalName": "USERNAME_1@example.invalid"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.user`	object
`$.user.agentType`	string
`$.user.displayName`	null
`$.user.id`	string
`$.user.ipAddress`	string
`$.user.roles`	array
`$.user.userPrincipalName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: RoleManagement · LoggedByService: PIM · OperationName: Add member to role in PIM completed (timebound)

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "user": {
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "ipAddress": null,
    "roles": [],
    "userPrincipalName": "USERNAME_1@example.invalid"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.user`	object
`$.user.agentType`	string
`$.user.displayName`	string
`$.user.id`	string
`$.user.ipAddress`	null
`$.user.roles`	array
`$.user.userPrincipalName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: UserManagement · LoggedByService: Core Directory · OperationName: Update user

All values in this example are synthetic. Format: JSON; column encoding: native-json.

{
  "user": {
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "ipAddress": "192.0.2.1",
    "userPrincipalName": "USERNAME_1@example.invalid"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.user`	object
`$.user.displayName`	string
`$.user.id`	string
`$.user.ipAddress`	string
`$.user.userPrincipalName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Update application

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "user": {
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "ipAddress": "192.0.2.1",
    "roles": [],
    "userPrincipalName": "USERNAME_1@example.invalid"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.user`	object
`$.user.agentType`	string
`$.user.displayName`	string
`$.user.id`	string
`$.user.ipAddress`	string
`$.user.roles`	array
`$.user.userPrincipalName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Add service principal

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "user": {
    "agentType": "VALUE_1",
    "displayName": null,
    "id": "00000000-0000-4000-8000-000000000001",
    "ipAddress": "192.0.2.1",
    "roles": [],
    "userPrincipalName": "USERNAME_1@example.invalid"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.user`	object
`$.user.agentType`	string
`$.user.displayName`	null
`$.user.id`	string
`$.user.ipAddress`	string
`$.user.roles`	array
`$.user.userPrincipalName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ProvisioningManagement · LoggedByService: Account Provisioning · OperationName: Execution

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "app": {
    "agentType": "VALUE_1",
    "appId": null,
    "blueprintId": null,
    "displayName": "USERNAME_1",
    "servicePrincipalId": null,
    "servicePrincipalName": null
  }
}

Payload fields and types

Path	Type
`$`	object
`$.app`	object
`$.app.agentType`	string
`$.app.appId`	null
`$.app.blueprintId`	null
`$.app.displayName`	string
`$.app.servicePrincipalId`	null
`$.app.servicePrincipalName`	null

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Add service principal

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "app": {
    "agentType": "VALUE_1",
    "appId": null,
    "blueprintId": null,
    "displayName": "USERNAME_1",
    "servicePrincipalId": "00000000-0000-4000-8000-000000000001",
    "servicePrincipalName": null
  }
}

Payload fields and types

Path	Type
`$`	object
`$.app`	object
`$.app.agentType`	string
`$.app.appId`	null
`$.app.blueprintId`	null
`$.app.displayName`	string
`$.app.servicePrincipalId`	string
`$.app.servicePrincipalName`	null

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ProvisioningManagement · LoggedByService: Account Provisioning · OperationName: Import

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "app": {
    "agentType": "VALUE_1",
    "appId": null,
    "blueprintId": null,
    "displayName": "USERNAME_1",
    "servicePrincipalId": null,
    "servicePrincipalName": null
  }
}

Payload fields and types

Path	Type
`$`	object
`$.app`	object
`$.app.agentType`	string
`$.app.appId`	null
`$.app.blueprintId`	null
`$.app.displayName`	string
`$.app.servicePrincipalId`	null
`$.app.servicePrincipalName`	null

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: GroupManagement · LoggedByService: Self-service Group Management · OperationName: Settings_GetSettingsAsync

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "app": {
    "agentType": "VALUE_1",
    "appId": null,
    "blueprintId": null,
    "displayName": "USERNAME_1@example.invalid",
    "servicePrincipalId": null,
    "servicePrincipalName": null
  }
}

Payload fields and types

Path	Type
`$`	object
`$.app`	object
`$.app.agentType`	string
`$.app.appId`	null
`$.app.blueprintId`	null
`$.app.displayName`	string
`$.app.servicePrincipalId`	null
`$.app.servicePrincipalName`	null

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Update service principal

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "user": {
    "agentType": "VALUE_1",
    "displayName": null,
    "id": "00000000-0000-4000-8000-000000000001",
    "ipAddress": "192.0.2.1",
    "roles": [],
    "userPrincipalName": "USERNAME_1@example.invalid"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.user`	object
`$.user.agentType`	string
`$.user.displayName`	null
`$.user.id`	string
`$.user.ipAddress`	string
`$.user.roles`	array
`$.user.userPrincipalName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Add delegated permission grant

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "user": {
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "ipAddress": "192.0.2.1",
    "roles": [],
    "userPrincipalName": "USERNAME_1@example.invalid"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.user`	object
`$.user.agentType`	string
`$.user.displayName`	string
`$.user.id`	string
`$.user.ipAddress`	string
`$.user.roles`	array
`$.user.userPrincipalName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Update application

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "user": {
    "agentType": "VALUE_1",
    "displayName": null,
    "id": "00000000-0000-4000-8000-000000000001",
    "ipAddress": "192.0.2.1",
    "roles": [],
    "userPrincipalName": "USERNAME_1@example.invalid"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.user`	object
`$.user.agentType`	string
`$.user.displayName`	null
`$.user.id`	string
`$.user.ipAddress`	string
`$.user.roles`	array
`$.user.userPrincipalName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Add application

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "user": {
    "agentType": "VALUE_1",
    "displayName": null,
    "id": "00000000-0000-4000-8000-000000000001",
    "ipAddress": "192.0.2.1",
    "roles": [],
    "userPrincipalName": "USERNAME_1@example.invalid"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.user`	object
`$.user.agentType`	string
`$.user.displayName`	null
`$.user.id`	string
`$.user.ipAddress`	string
`$.user.roles`	array
`$.user.userPrincipalName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ProvisioningManagement · LoggedByService: Account Provisioning · OperationName: Other

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "app": {
    "agentType": "VALUE_1",
    "appId": null,
    "blueprintId": null,
    "displayName": "USERNAME_1",
    "servicePrincipalId": null,
    "servicePrincipalName": null
  }
}

Payload fields and types

Path	Type
`$`	object
`$.app`	object
`$.app.agentType`	string
`$.app.appId`	null
`$.app.blueprintId`	null
`$.app.displayName`	string
`$.app.servicePrincipalId`	null
`$.app.servicePrincipalName`	null

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: Authentication · LoggedByService: B2C · OperationName: Validate user authentication

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "user": {
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1@example.invalid",
    "id": "00000000-0000-4000-8000-000000000001",
    "ipAddress": "192.0.2.1",
    "roles": [],
    "userPrincipalName": "USERNAME_1@example.invalid"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.user`	object
`$.user.agentType`	string
`$.user.displayName`	string
`$.user.id`	string
`$.user.ipAddress`	string
`$.user.roles`	array
`$.user.userPrincipalName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: UserManagement · LoggedByService: Core Directory · OperationName: Add app role assignment grant to user

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "user": {
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "ipAddress": "192.0.2.1",
    "roles": [],
    "userPrincipalName": "USERNAME_1@example.invalid"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.user`	object
`$.user.agentType`	string
`$.user.displayName`	string
`$.user.id`	string
`$.user.ipAddress`	string
`$.user.roles`	array
`$.user.userPrincipalName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Create application – Certificates and secrets management

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "user": {
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "ipAddress": "192.0.2.1",
    "roles": [],
    "userPrincipalName": "USERNAME_1@example.invalid"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.user`	object
`$.user.agentType`	string
`$.user.displayName`	string
`$.user.id`	string
`$.user.ipAddress`	string
`$.user.roles`	array
`$.user.userPrincipalName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Add app role assignment to service principal

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "user": {
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "ipAddress": "192.0.2.1",
    "roles": [],
    "userPrincipalName": "USERNAME_1@example.invalid"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.user`	object
`$.user.agentType`	string
`$.user.displayName`	string
`$.user.id`	string
`$.user.ipAddress`	string
`$.user.roles`	array
`$.user.userPrincipalName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ProvisioningManagement · LoggedByService: Account Provisioning · OperationName: Synchronization rule action

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "app": {
    "agentType": "VALUE_1",
    "appId": null,
    "blueprintId": null,
    "displayName": "USERNAME_1",
    "servicePrincipalId": null,
    "servicePrincipalName": null
  }
}

Payload fields and types

Path	Type
`$`	object
`$.app`	object
`$.app.agentType`	string
`$.app.appId`	null
`$.app.blueprintId`	null
`$.app.displayName`	string
`$.app.servicePrincipalId`	null
`$.app.servicePrincipalName`	null

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: GroupManagement · LoggedByService: Self-service Group Management · OperationName: GroupLifecyclePolicies_Get

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "app": {
    "agentType": "VALUE_1",
    "appId": null,
    "blueprintId": null,
    "displayName": null,
    "servicePrincipalId": null,
    "servicePrincipalName": null
  }
}

Payload fields and types

Path	Type
`$`	object
`$.app`	object
`$.app.agentType`	string
`$.app.appId`	null
`$.app.blueprintId`	null
`$.app.displayName`	null
`$.app.servicePrincipalId`	null
`$.app.servicePrincipalName`	null

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Add delegated permission grant

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "user": {
    "agentType": "VALUE_1",
    "displayName": null,
    "id": "00000000-0000-4000-8000-000000000001",
    "ipAddress": "192.0.2.1",
    "roles": [],
    "userPrincipalName": "USERNAME_1@example.invalid"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.user`	object
`$.user.agentType`	string
`$.user.displayName`	null
`$.user.id`	string
`$.user.ipAddress`	string
`$.user.roles`	array
`$.user.userPrincipalName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Add service principal

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "user": {
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "ipAddress": "192.0.2.1",
    "roles": [],
    "userPrincipalName": "USERNAME_1@example.invalid"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.user`	object
`$.user.agentType`	string
`$.user.displayName`	string
`$.user.id`	string
`$.user.ipAddress`	string
`$.user.roles`	array
`$.user.userPrincipalName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Update service principal

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "user": {
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "ipAddress": "192.0.2.1",
    "roles": [],
    "userPrincipalName": "USERNAME_1@example.invalid"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.user`	object
`$.user.agentType`	string
`$.user.displayName`	string
`$.user.id`	string
`$.user.ipAddress`	string
`$.user.roles`	array
`$.user.userPrincipalName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

`TargetResources`

Submit an example

Category: RoleManagement · LoggedByService: PIM · OperationName: Add member to role in PIM requested (timebound)

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME",
    "id": "00000000-0000-4000-8000-000000000003",
    "modifiedProperties": [],
    "type": "User",
    "userPrincipalName": "USERNAME_1@example.invalid"
  },
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "EXAMPLE_LABEL_001",
        "newValue": "\"00000000-0000-4000-8000-000000000001\"",
        "oldValue": "\"VALUE_2\""
      },
      {
        "displayName": "EXAMPLE_LABEL_002",
        "newValue": "\"VALUE_3\"",
        "oldValue": "\"VALUE_2\""
      },
      {
        "displayName": "EXAMPLE_LABEL_003",
        "newValue": "\"00000000-0000-4000-8000-000000000001\"",
        "oldValue": "\"VALUE_2\""
      }
    ],
    "type": "VALUE_4"
  },
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_2",
    "id": "00000000-0000-4000-8000-000000000002",
    "modifiedProperties": [],
    "type": "VALUE_5"
  },
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": null,
    "id": "00000000-0000-4000-8000-000000000004",
    "modifiedProperties": [],
    "type": "VALUE_7"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	null
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].oldValue`	encoded-json
`$[].modifiedProperties[].oldValue`	string
`$[].modifiedProperties[].oldValue::<json>`	string
`$[].modifiedProperties[][displayName=EXAMPLE_LABEL_001]`	named-property
`$[].modifiedProperties[][displayName=EXAMPLE_LABEL_002]`	named-property
`$[].modifiedProperties[][displayName=EXAMPLE_LABEL_003]`	named-property
`$[].type`	string
`$[].userPrincipalName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ProvisioningManagement · LoggedByService: Account Provisioning · OperationName: Synchronization rule action

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "00000000-0000-4000-8000-000000000002",
    "id": null,
    "modifiedProperties": [],
    "type": "VALUE_2"
  },
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [],
    "type": "ServicePrincipal"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	null
`$[].id`	string
`$[].modifiedProperties`	array
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Update service principal

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "AppAddress",
        "newValue": "[{\"Address\":\"https://example.invalid/SAMPLE_1\",\"AddressType\":1,\"IsReplyAddressDefault\":false,\"ReplyAddressClientType\":1,\"ReplyAddressIndex\":null}]",
        "oldValue": "[{\"Address\":\"https://example.invalid/SAMPLE_2\",\"AddressType\":1,\"IsReplyAddressDefault\":false,\"ReplyAddressClientType\":1,\"ReplyAddressIndex\":null}]"
      },
      {
        "displayName": "Included Updated Properties",
        "newValue": "\"VALUE_2\"",
        "oldValue": null
      }
    ],
    "type": "ServicePrincipal"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	array
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].newValue::<json>[]`	object
`$[].modifiedProperties[].newValue::<json>[].Address`	string
`$[].modifiedProperties[].newValue::<json>[].AddressType`	integer
`$[].modifiedProperties[].newValue::<json>[].IsReplyAddressDefault`	boolean
`$[].modifiedProperties[].newValue::<json>[].ReplyAddressClientType`	integer
`$[].modifiedProperties[].newValue::<json>[].ReplyAddressIndex`	null
`$[].modifiedProperties[].oldValue`	encoded-json
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[].oldValue`	string
`$[].modifiedProperties[].oldValue::<json>`	array
`$[].modifiedProperties[].oldValue::<json>[]`	object
`$[].modifiedProperties[].oldValue::<json>[].Address`	string
`$[].modifiedProperties[].oldValue::<json>[].AddressType`	integer
`$[].modifiedProperties[].oldValue::<json>[].IsReplyAddressDefault`	boolean
`$[].modifiedProperties[].oldValue::<json>[].ReplyAddressClientType`	integer
`$[].modifiedProperties[].oldValue::<json>[].ReplyAddressIndex`	null
`$[].modifiedProperties[][displayName=AppAddress]`	named-property
`$[].modifiedProperties[][displayName=Included Updated Properties]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Remove service principal

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [],
    "type": "ServicePrincipal"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Remove service principal credentials

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "Included Updated Properties",
        "newValue": "\"VALUE_4\"",
        "oldValue": null
      },
      {
        "displayName": "KeyDescription",
        "newValue": "[\"VALUE_2\"]",
        "oldValue": "[\"VALUE_3\"]"
      }
    ],
    "type": "ServicePrincipal"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	array
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].newValue::<json>[]`	string
`$[].modifiedProperties[].oldValue`	encoded-json
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[].oldValue`	string
`$[].modifiedProperties[].oldValue::<json>`	array
`$[].modifiedProperties[].oldValue::<json>[]`	string
`$[].modifiedProperties[][displayName=Included Updated Properties]`	named-property
`$[].modifiedProperties[][displayName=KeyDescription]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: UserManagement · LoggedByService: Core Directory · OperationName: Update user

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": null,
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "MethodExecutionResult.",
        "newValue": "\"VALUE_2\"",
        "oldValue": null
      },
      {
        "displayName": "TargetId.UserType",
        "newValue": "\"VALUE_3\"",
        "oldValue": null
      }
    ],
    "type": "User",
    "userPrincipalName": "USERNAME_1@example.invalid"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	null
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[][displayName=MethodExecutionResult.]`	named-property
`$[].modifiedProperties[][displayName=TargetId.UserType]`	named-property
`$[].type`	string
`$[].userPrincipalName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Add delegated permission grant

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "EXAMPLE_LABEL_001",
        "newValue": "\"VALUE_4\"",
        "oldValue": "\"VALUE_4\""
      },
      {
        "displayName": "EXAMPLE_LABEL_002",
        "newValue": "\"VALUE_2\"",
        "oldValue": "\"VALUE_3\""
      },
      {
        "displayName": "ServicePrincipal.AppId",
        "newValue": null,
        "oldValue": null
      },
      {
        "displayName": "ServicePrincipal.DisplayName",
        "newValue": null,
        "oldValue": null
      },
      {
        "displayName": "ServicePrincipal.Name",
        "newValue": null,
        "oldValue": null
      },
      {
        "displayName": "ServicePrincipal.ObjectID",
        "newValue": "\"00000000-0000-4000-8000-000000000002\"",
        "oldValue": null
      },
      {
        "displayName": "TargetId.ServicePrincipalNames",
        "newValue": "\"VALUE_5\"",
        "oldValue": null
      }
    ],
    "type": "ServicePrincipal"
  },
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": null,
    "id": "00000000-0000-4000-8000-000000000002",
    "modifiedProperties": [],
    "type": "ServicePrincipal"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	null
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	null
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].oldValue`	encoded-json
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[].oldValue`	string
`$[].modifiedProperties[].oldValue::<json>`	string
`$[].modifiedProperties[][displayName=EXAMPLE_LABEL_001]`	named-property
`$[].modifiedProperties[][displayName=EXAMPLE_LABEL_002]`	named-property
`$[].modifiedProperties[][displayName=ServicePrincipal.AppId]`	named-property
`$[].modifiedProperties[][displayName=ServicePrincipal.DisplayName]`	named-property
`$[].modifiedProperties[][displayName=ServicePrincipal.Name]`	named-property
`$[].modifiedProperties[][displayName=ServicePrincipal.ObjectID]`	named-property
`$[].modifiedProperties[][displayName=TargetId.ServicePrincipalNames]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: Device · LoggedByService: Core Directory · OperationName: Update device

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "CloudDeviceOSVersion",
        "newValue": "[\"VALUE_2\"]",
        "oldValue": "[\"VALUE_3\"]"
      },
      {
        "displayName": "DeviceOSVersion",
        "newValue": "[\"VALUE_2\"]",
        "oldValue": "[\"VALUE_3\"]"
      },
      {
        "displayName": "Included Updated Properties",
        "newValue": "\"VALUE_4\"",
        "oldValue": null
      },
      {
        "displayName": "TargetId.DeviceId",
        "newValue": "\"00000000-0000-4000-8000-000000000002\"",
        "oldValue": null
      },
      {
        "displayName": "TargetId.DeviceOSType",
        "newValue": "\"VALUE_5\"",
        "oldValue": null
      },
      {
        "displayName": "TargetId.DeviceTrustType",
        "newValue": "\"VALUE_6\"",
        "oldValue": null
      }
    ],
    "type": "VALUE_7"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	array
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].newValue::<json>[]`	string
`$[].modifiedProperties[].oldValue`	encoded-json
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[].oldValue`	string
`$[].modifiedProperties[].oldValue::<json>`	array
`$[].modifiedProperties[].oldValue::<json>[]`	string
`$[].modifiedProperties[][displayName=CloudDeviceOSVersion]`	named-property
`$[].modifiedProperties[][displayName=DeviceOSVersion]`	named-property
`$[].modifiedProperties[][displayName=Included Updated Properties]`	named-property
`$[].modifiedProperties[][displayName=TargetId.DeviceId]`	named-property
`$[].modifiedProperties[][displayName=TargetId.DeviceOSType]`	named-property
`$[].modifiedProperties[][displayName=TargetId.DeviceTrustType]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Add application

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "AppId",
        "newValue": "[\"00000000-0000-4000-8000-000000000002\"]",
        "oldValue": "[]"
      },
      {
        "displayName": "DisplayName",
        "newValue": "[\"VALUE_2\"]",
        "oldValue": "[]"
      },
      {
        "displayName": "EXAMPLE_LABEL_001",
        "newValue": "[false]",
        "oldValue": "[]"
      },
      {
        "displayName": "EXAMPLE_LABEL_002",
        "newValue": "[\"VALUE_3\"]",
        "oldValue": "[]"
      },
      {
        "displayName": "EXAMPLE_LABEL_003",
        "newValue": "[{\"AllProperties\":false,\"CredentialsWithUsageSign\":null,\"CredentialsWithUsageVerify\":null,\"IdentifierUris\":null,\"IsEnabled\":false,\"ServicePrincipalLockExtension\":\"VALUE_4\",\"TokenEncryptionKeyId\":null}]",
        "oldValue": "[]"
      },
      {
        "displayName": "EXAMPLE_LABEL_004",
        "newValue": "[\"VALUE_5\"]",
        "oldValue": "[]"
      },
      {
        "displayName": "Included Updated Properties",
        "newValue": "\"VALUE_6\"",
        "oldValue": null
      }
    ],
    "type": "Application"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	array
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].newValue::<json>[]`	boolean
`$[].modifiedProperties[].newValue::<json>[]`	object
`$[].modifiedProperties[].newValue::<json>[]`	string
`$[].modifiedProperties[].newValue::<json>[].AllProperties`	boolean
`$[].modifiedProperties[].newValue::<json>[].CredentialsWithUsageSign`	null
`$[].modifiedProperties[].newValue::<json>[].CredentialsWithUsageVerify`	null
`$[].modifiedProperties[].newValue::<json>[].IdentifierUris`	null
`$[].modifiedProperties[].newValue::<json>[].IsEnabled`	boolean
`$[].modifiedProperties[].newValue::<json>[].ServicePrincipalLockExtension`	string
`$[].modifiedProperties[].newValue::<json>[].TokenEncryptionKeyId`	null
`$[].modifiedProperties[].oldValue`	encoded-json
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[].oldValue`	string
`$[].modifiedProperties[].oldValue::<json>`	array
`$[].modifiedProperties[][displayName=AppId]`	named-property
`$[].modifiedProperties[][displayName=DisplayName]`	named-property
`$[].modifiedProperties[][displayName=EXAMPLE_LABEL_001]`	named-property
`$[].modifiedProperties[][displayName=EXAMPLE_LABEL_002]`	named-property
`$[].modifiedProperties[][displayName=EXAMPLE_LABEL_003]`	named-property
`$[].modifiedProperties[][displayName=EXAMPLE_LABEL_004]`	named-property
`$[].modifiedProperties[][displayName=Included Updated Properties]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Add service principal

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "AccountEnabled",
        "newValue": "[false]",
        "oldValue": "[]"
      },
      {
        "displayName": "AppPrincipalId",
        "newValue": "[\"00000000-0000-4000-8000-000000000002\"]",
        "oldValue": "[]"
      },
      {
        "displayName": "Credential",
        "newValue": "[{\"CredentialType\":1,\"KeyGroupId\":\"00000000-0000-4000-8000-000000000002\",\"KeyStoreId\":\"00000000-0000-4000-8000-000000000003\"}]",
        "oldValue": "[]"
      },
      {
        "displayName": "DisplayName",
        "newValue": "[\"VALUE_2\"]",
        "oldValue": "[]"
      },
      {
        "displayName": "Included Updated Properties",
        "newValue": "\"VALUE_7\"",
        "oldValue": null
      },
      {
        "displayName": "ServicePrincipalName",
        "newValue": "[\"https://example.invalid/SAMPLE_1\"]",
        "oldValue": "[]"
      },
      {
        "displayName": "ServicePrincipalTag",
        "newValue": "[\"VALUE_4\"]",
        "oldValue": "[]"
      }
    ],
    "type": "ServicePrincipal"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	array
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].newValue::<json>[]`	boolean
`$[].modifiedProperties[].newValue::<json>[]`	object
`$[].modifiedProperties[].newValue::<json>[]`	string
`$[].modifiedProperties[].newValue::<json>[].CredentialType`	integer
`$[].modifiedProperties[].newValue::<json>[].KeyGroupId`	string
`$[].modifiedProperties[].newValue::<json>[].KeyStoreId`	string
`$[].modifiedProperties[].oldValue`	encoded-json
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[].oldValue`	string
`$[].modifiedProperties[].oldValue::<json>`	array
`$[].modifiedProperties[][displayName=AccountEnabled]`	named-property
`$[].modifiedProperties[][displayName=AppPrincipalId]`	named-property
`$[].modifiedProperties[][displayName=Credential]`	named-property
`$[].modifiedProperties[][displayName=DisplayName]`	named-property
`$[].modifiedProperties[][displayName=Included Updated Properties]`	named-property
`$[].modifiedProperties[][displayName=ServicePrincipalName]`	named-property
`$[].modifiedProperties[][displayName=ServicePrincipalTag]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Update service principal

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "AppAddress",
        "newValue": "[{\"Address\":\"https://example.invalid/SAMPLE_1\",\"AddressType\":1,\"IsReplyAddressDefault\":false,\"ReplyAddressClientType\":1,\"ReplyAddressIndex\":null}]",
        "oldValue": "[]"
      },
      {
        "displayName": "Included Updated Properties",
        "newValue": "\"VALUE_2\"",
        "oldValue": null
      }
    ],
    "type": "ServicePrincipal"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	array
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].newValue::<json>[]`	object
`$[].modifiedProperties[].newValue::<json>[].Address`	string
`$[].modifiedProperties[].newValue::<json>[].AddressType`	integer
`$[].modifiedProperties[].newValue::<json>[].IsReplyAddressDefault`	boolean
`$[].modifiedProperties[].newValue::<json>[].ReplyAddressClientType`	integer
`$[].modifiedProperties[].newValue::<json>[].ReplyAddressIndex`	null
`$[].modifiedProperties[].oldValue`	encoded-json
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[].oldValue`	string
`$[].modifiedProperties[].oldValue::<json>`	array
`$[].modifiedProperties[][displayName=AppAddress]`	named-property
`$[].modifiedProperties[][displayName=Included Updated Properties]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ProvisioningManagement · LoggedByService: Account Provisioning · OperationName: Import

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": null,
    "modifiedProperties": [],
    "type": "VALUE_7"
  },
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": null,
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "countryLetterCode",
        "newValue": "\"VALUE_3\"",
        "oldValue": null
      },
      {
        "displayName": "dirSyncEnabled",
        "newValue": "\"VALUE_2\"",
        "oldValue": null
      },
      {
        "displayName": "displayName",
        "newValue": "\"VALUE_4\"",
        "oldValue": null
      },
      {
        "displayName": "objectId",
        "newValue": "\"00000000-0000-4000-8000-000000000002\"",
        "oldValue": null
      },
      {
        "displayName": "replicationScope",
        "newValue": "\"VALUE_5\"",
        "oldValue": null
      },
      {
        "displayName": "technicalNotificationMails",
        "newValue": "\"USERNAME_1@example.invalid\"",
        "oldValue": null
      },
      {
        "displayName": "verifiedDomains",
        "newValue": "\"VALUE_6\"",
        "oldValue": null
      }
    ],
    "type": "ServicePrincipal"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	null
`$[].displayName`	string
`$[].id`	null
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[][displayName=countryLetterCode]`	named-property
`$[].modifiedProperties[][displayName=dirSyncEnabled]`	named-property
`$[].modifiedProperties[][displayName=displayName]`	named-property
`$[].modifiedProperties[][displayName=objectId]`	named-property
`$[].modifiedProperties[][displayName=replicationScope]`	named-property
`$[].modifiedProperties[][displayName=technicalNotificationMails]`	named-property
`$[].modifiedProperties[][displayName=verifiedDomains]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Update application

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "FederatedIdentityCredentials",
        "newValue": "[]",
        "oldValue": "[{\"Audiences\":[\"VALUE_2\"],\"ClaimsMatchingExpressionLanguageVersion\":1,\"ClaimsMatchingExpressionValue\":null,\"Description\":\"VALUE_3\",\"EncodingVersion\":1,\"Id\":\"00000000-0000-4000-8000-000000000002\",\"Issuer\":\"https://example.invalid/SAMPLE_1\",\"Name\":\"USERNAME_2\",\"Subject\":\"00000000-0000-4000-8000-000000000003\",\"TrustedIssuer\":null}]"
      },
      {
        "displayName": "Included Updated Properties",
        "newValue": "\"VALUE_4\"",
        "oldValue": null
      }
    ],
    "type": "Application"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	array
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].oldValue`	encoded-json
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[].oldValue`	string
`$[].modifiedProperties[].oldValue::<json>`	array
`$[].modifiedProperties[].oldValue::<json>[]`	object
`$[].modifiedProperties[].oldValue::<json>[].Audiences`	array
`$[].modifiedProperties[].oldValue::<json>[].Audiences[]`	string
`$[].modifiedProperties[].oldValue::<json>[].ClaimsMatchingExpressionLanguageVersion`	integer
`$[].modifiedProperties[].oldValue::<json>[].ClaimsMatchingExpressionValue`	null
`$[].modifiedProperties[].oldValue::<json>[].Description`	string
`$[].modifiedProperties[].oldValue::<json>[].EncodingVersion`	integer
`$[].modifiedProperties[].oldValue::<json>[].Id`	string
`$[].modifiedProperties[].oldValue::<json>[].Issuer`	string
`$[].modifiedProperties[].oldValue::<json>[].Name`	string
`$[].modifiedProperties[].oldValue::<json>[].Subject`	string
`$[].modifiedProperties[].oldValue::<json>[].TrustedIssuer`	null
`$[].modifiedProperties[][displayName=FederatedIdentityCredentials]`	named-property
`$[].modifiedProperties[][displayName=Included Updated Properties]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Add service principal

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "AccountEnabled",
        "newValue": "[false]",
        "oldValue": "[]"
      },
      {
        "displayName": "AppPrincipalId",
        "newValue": "[\"00000000-0000-4000-8000-000000000002\"]",
        "oldValue": "[]"
      },
      {
        "displayName": "Credential",
        "newValue": "[{\"CredentialType\":1,\"KeyGroupId\":\"00000000-0000-4000-8000-000000000003\",\"KeyStoreId\":\"00000000-0000-4000-8000-000000000003\"}]",
        "oldValue": "[]"
      },
      {
        "displayName": "DisplayName",
        "newValue": "[\"VALUE_2\"]",
        "oldValue": "[]"
      },
      {
        "displayName": "Included Updated Properties",
        "newValue": "\"VALUE_4\"",
        "oldValue": null
      },
      {
        "displayName": "ServicePrincipalName",
        "newValue": "[\"00000000-0000-4000-8000-000000000002\"]",
        "oldValue": "[]"
      }
    ],
    "type": "ServicePrincipal"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	array
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].newValue::<json>[]`	boolean
`$[].modifiedProperties[].newValue::<json>[]`	object
`$[].modifiedProperties[].newValue::<json>[]`	string
`$[].modifiedProperties[].newValue::<json>[].CredentialType`	integer
`$[].modifiedProperties[].newValue::<json>[].KeyGroupId`	string
`$[].modifiedProperties[].newValue::<json>[].KeyStoreId`	string
`$[].modifiedProperties[].oldValue`	encoded-json
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[].oldValue`	string
`$[].modifiedProperties[].oldValue::<json>`	array
`$[].modifiedProperties[][displayName=AccountEnabled]`	named-property
`$[].modifiedProperties[][displayName=AppPrincipalId]`	named-property
`$[].modifiedProperties[][displayName=Credential]`	named-property
`$[].modifiedProperties[][displayName=DisplayName]`	named-property
`$[].modifiedProperties[][displayName=Included Updated Properties]`	named-property
`$[].modifiedProperties[][displayName=ServicePrincipalName]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Add service principal

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "AccountEnabled",
        "newValue": "[false]",
        "oldValue": "[]"
      },
      {
        "displayName": "AppPrincipalId",
        "newValue": "[\"00000000-0000-4000-8000-000000000002\"]",
        "oldValue": "[]"
      },
      {
        "displayName": "Credential",
        "newValue": "[{\"CredentialType\":1,\"KeyGroupId\":\"00000000-0000-4000-8000-000000000003\",\"KeyStoreId\":\"00000000-0000-4000-8000-000000000003\"}]",
        "oldValue": "[]"
      },
      {
        "displayName": "DisplayName",
        "newValue": "[\"VALUE_2\"]",
        "oldValue": "[]"
      },
      {
        "displayName": "Included Updated Properties",
        "newValue": "\"VALUE_7\"",
        "oldValue": null
      },
      {
        "displayName": "KeyDescription",
        "newValue": "[\"VALUE_3\"]",
        "oldValue": "[]"
      },
      {
        "displayName": "ManagedIdentityResourceId",
        "newValue": "[\"VALUE_4\"]",
        "oldValue": "[]"
      },
      {
        "displayName": "ServicePrincipalName",
        "newValue": "[\"https://example.invalid/SAMPLE_1\"]",
        "oldValue": "[]"
      },
      {
        "displayName": "ServicePrincipalTag",
        "newValue": "[\"VALUE_5\"]",
        "oldValue": "[]"
      }
    ],
    "type": "ServicePrincipal"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	array
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].newValue::<json>[]`	boolean
`$[].modifiedProperties[].newValue::<json>[]`	object
`$[].modifiedProperties[].newValue::<json>[]`	string
`$[].modifiedProperties[].newValue::<json>[].CredentialType`	integer
`$[].modifiedProperties[].newValue::<json>[].KeyGroupId`	string
`$[].modifiedProperties[].newValue::<json>[].KeyStoreId`	string
`$[].modifiedProperties[].oldValue`	encoded-json
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[].oldValue`	string
`$[].modifiedProperties[].oldValue::<json>`	array
`$[].modifiedProperties[][displayName=AccountEnabled]`	named-property
`$[].modifiedProperties[][displayName=AppPrincipalId]`	named-property
`$[].modifiedProperties[][displayName=Credential]`	named-property
`$[].modifiedProperties[][displayName=DisplayName]`	named-property
`$[].modifiedProperties[][displayName=Included Updated Properties]`	named-property
`$[].modifiedProperties[][displayName=KeyDescription]`	named-property
`$[].modifiedProperties[][displayName=ManagedIdentityResourceId]`	named-property
`$[].modifiedProperties[][displayName=ServicePrincipalName]`	named-property
`$[].modifiedProperties[][displayName=ServicePrincipalTag]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Update application

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "FederatedIdentityCredentials",
        "newValue": "[{\"Audiences\":[\"VALUE_2\"],\"ClaimsMatchingExpressionLanguageVersion\":1,\"ClaimsMatchingExpressionValue\":null,\"Description\":\"VALUE_3\",\"EncodingVersion\":1,\"Id\":\"00000000-0000-4000-8000-000000000002\",\"Issuer\":\"https://example.invalid/SAMPLE_1\",\"Name\":\"USERNAME_2\",\"Subject\":\"00000000-0000-4000-8000-000000000003\",\"TrustedIssuer\":null}]",
        "oldValue": "[]"
      },
      {
        "displayName": "Included Updated Properties",
        "newValue": "\"VALUE_4\"",
        "oldValue": null
      }
    ],
    "type": "Application"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	array
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].newValue::<json>[]`	object
`$[].modifiedProperties[].newValue::<json>[].Audiences`	array
`$[].modifiedProperties[].newValue::<json>[].Audiences[]`	string
`$[].modifiedProperties[].newValue::<json>[].ClaimsMatchingExpressionLanguageVersion`	integer
`$[].modifiedProperties[].newValue::<json>[].ClaimsMatchingExpressionValue`	null
`$[].modifiedProperties[].newValue::<json>[].Description`	string
`$[].modifiedProperties[].newValue::<json>[].EncodingVersion`	integer
`$[].modifiedProperties[].newValue::<json>[].Id`	string
`$[].modifiedProperties[].newValue::<json>[].Issuer`	string
`$[].modifiedProperties[].newValue::<json>[].Name`	string
`$[].modifiedProperties[].newValue::<json>[].Subject`	string
`$[].modifiedProperties[].newValue::<json>[].TrustedIssuer`	null
`$[].modifiedProperties[].oldValue`	encoded-json
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[].oldValue`	string
`$[].modifiedProperties[].oldValue::<json>`	array
`$[].modifiedProperties[][displayName=FederatedIdentityCredentials]`	named-property
`$[].modifiedProperties[][displayName=Included Updated Properties]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Update application

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "Included Updated Properties",
        "newValue": "\"VALUE_2\"",
        "oldValue": null
      },
      {
        "displayName": "RequiredResourceAccess",
        "newValue": "[]",
        "oldValue": "[{\"EncodingVersion\":1,\"RequiredAppPermissions\":[{\"DirectAccessGrant\":false,\"EntitlementId\":\"00000000-0000-4000-8000-000000000002\",\"ImpersonationAccessGrants\":[1]}],\"ResourceAppId\":\"00000000-0000-4000-8000-000000000003\"}]"
      }
    ],
    "type": "Application"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	array
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].oldValue`	encoded-json
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[].oldValue`	string
`$[].modifiedProperties[].oldValue::<json>`	array
`$[].modifiedProperties[].oldValue::<json>[]`	object
`$[].modifiedProperties[].oldValue::<json>[].EncodingVersion`	integer
`$[].modifiedProperties[].oldValue::<json>[].RequiredAppPermissions`	array
`$[].modifiedProperties[].oldValue::<json>[].RequiredAppPermissions[]`	object
`$[].modifiedProperties[].oldValue::<json>[].RequiredAppPermissions[].DirectAccessGrant`	boolean
`$[].modifiedProperties[].oldValue::<json>[].RequiredAppPermissions[].EntitlementId`	string
`$[].modifiedProperties[].oldValue::<json>[].RequiredAppPermissions[].ImpersonationAccessGrants`	array
`$[].modifiedProperties[].oldValue::<json>[].RequiredAppPermissions[].ImpersonationAccessGrants[]`	integer
`$[].modifiedProperties[].oldValue::<json>[].ResourceAppId`	string
`$[].modifiedProperties[][displayName=Included Updated Properties]`	named-property
`$[].modifiedProperties[][displayName=RequiredResourceAccess]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Add service principal

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "AccountEnabled",
        "newValue": "[false]",
        "oldValue": "[]"
      },
      {
        "displayName": "AppAddress",
        "newValue": "[{\"Address\":\"VALUE_2\",\"AddressType\":1,\"IsReplyAddressDefault\":false,\"ReplyAddressClientType\":1,\"ReplyAddressIndex\":null}]",
        "oldValue": "[]"
      },
      {
        "displayName": "AppPrincipalId",
        "newValue": "[\"00000000-0000-4000-8000-000000000002\"]",
        "oldValue": "[]"
      },
      {
        "displayName": "Credential",
        "newValue": "[{\"CredentialType\":1,\"KeyGroupId\":\"00000000-0000-4000-8000-000000000003\",\"KeyStoreId\":\"00000000-0000-4000-8000-000000000003\"}]",
        "oldValue": "[]"
      },
      {
        "displayName": "DisplayName",
        "newValue": "[\"VALUE_4\"]",
        "oldValue": "[]"
      },
      {
        "displayName": "Included Updated Properties",
        "newValue": "\"VALUE_8\"",
        "oldValue": null
      },
      {
        "displayName": "ServicePrincipalName",
        "newValue": "[\"00000000-0000-4000-8000-000000000002\"]",
        "oldValue": "[]"
      },
      {
        "displayName": "ServicePrincipalTag",
        "newValue": "[\"VALUE_5\"]",
        "oldValue": "[]"
      }
    ],
    "type": "ServicePrincipal"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	array
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].newValue::<json>[]`	boolean
`$[].modifiedProperties[].newValue::<json>[]`	object
`$[].modifiedProperties[].newValue::<json>[]`	string
`$[].modifiedProperties[].newValue::<json>[].Address`	string
`$[].modifiedProperties[].newValue::<json>[].AddressType`	integer
`$[].modifiedProperties[].newValue::<json>[].CredentialType`	integer
`$[].modifiedProperties[].newValue::<json>[].IsReplyAddressDefault`	boolean
`$[].modifiedProperties[].newValue::<json>[].KeyGroupId`	string
`$[].modifiedProperties[].newValue::<json>[].KeyStoreId`	string
`$[].modifiedProperties[].newValue::<json>[].ReplyAddressClientType`	integer
`$[].modifiedProperties[].newValue::<json>[].ReplyAddressIndex`	null
`$[].modifiedProperties[].oldValue`	encoded-json
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[].oldValue`	string
`$[].modifiedProperties[].oldValue::<json>`	array
`$[].modifiedProperties[][displayName=AccountEnabled]`	named-property
`$[].modifiedProperties[][displayName=AppAddress]`	named-property
`$[].modifiedProperties[][displayName=AppPrincipalId]`	named-property
`$[].modifiedProperties[][displayName=Credential]`	named-property
`$[].modifiedProperties[][displayName=DisplayName]`	named-property
`$[].modifiedProperties[][displayName=Included Updated Properties]`	named-property
`$[].modifiedProperties[][displayName=ServicePrincipalName]`	named-property
`$[].modifiedProperties[][displayName=ServicePrincipalTag]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Update application

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "AppAddress",
        "newValue": "[{\"Address\":\"https://example.invalid/SAMPLE_1\",\"AddressType\":1,\"IsReplyAddressDefault\":false,\"ReplyAddressClientType\":1,\"ReplyAddressIndex\":null}]",
        "oldValue": "[]"
      },
      {
        "displayName": "Included Updated Properties",
        "newValue": "\"VALUE_2\"",
        "oldValue": null
      }
    ],
    "type": "Application"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	array
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].newValue::<json>[]`	object
`$[].modifiedProperties[].newValue::<json>[].Address`	string
`$[].modifiedProperties[].newValue::<json>[].AddressType`	integer
`$[].modifiedProperties[].newValue::<json>[].IsReplyAddressDefault`	boolean
`$[].modifiedProperties[].newValue::<json>[].ReplyAddressClientType`	integer
`$[].modifiedProperties[].newValue::<json>[].ReplyAddressIndex`	null
`$[].modifiedProperties[].oldValue`	encoded-json
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[].oldValue`	string
`$[].modifiedProperties[].oldValue::<json>`	array
`$[].modifiedProperties[][displayName=AppAddress]`	named-property
`$[].modifiedProperties[][displayName=Included Updated Properties]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Add service principal

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "AccountEnabled",
        "newValue": "[false]",
        "oldValue": "[]"
      },
      {
        "displayName": "AppPrincipalId",
        "newValue": "[\"00000000-0000-4000-8000-000000000002\"]",
        "oldValue": "[]"
      },
      {
        "displayName": "Credential",
        "newValue": "[{\"CredentialType\":1,\"KeyGroupId\":\"00000000-0000-4000-8000-000000000003\",\"KeyStoreId\":\"00000000-0000-4000-8000-000000000003\"}]",
        "oldValue": "[]"
      },
      {
        "displayName": "DisplayName",
        "newValue": "[\"VALUE_2\"]",
        "oldValue": "[]"
      },
      {
        "displayName": "Included Updated Properties",
        "newValue": "\"VALUE_5\"",
        "oldValue": null
      },
      {
        "displayName": "KeyDescription",
        "newValue": "[\"VALUE_3\"]",
        "oldValue": "[]"
      },
      {
        "displayName": "ManagedIdentityResourceId",
        "newValue": "[\"VALUE_4\"]",
        "oldValue": "[]"
      },
      {
        "displayName": "ServicePrincipalName",
        "newValue": "[\"https://example.invalid/SAMPLE_1\"]",
        "oldValue": "[]"
      }
    ],
    "type": "ServicePrincipal"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	array
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].newValue::<json>[]`	boolean
`$[].modifiedProperties[].newValue::<json>[]`	object
`$[].modifiedProperties[].newValue::<json>[]`	string
`$[].modifiedProperties[].newValue::<json>[].CredentialType`	integer
`$[].modifiedProperties[].newValue::<json>[].KeyGroupId`	string
`$[].modifiedProperties[].newValue::<json>[].KeyStoreId`	string
`$[].modifiedProperties[].oldValue`	encoded-json
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[].oldValue`	string
`$[].modifiedProperties[].oldValue::<json>`	array
`$[].modifiedProperties[][displayName=AccountEnabled]`	named-property
`$[].modifiedProperties[][displayName=AppPrincipalId]`	named-property
`$[].modifiedProperties[][displayName=Credential]`	named-property
`$[].modifiedProperties[][displayName=DisplayName]`	named-property
`$[].modifiedProperties[][displayName=Included Updated Properties]`	named-property
`$[].modifiedProperties[][displayName=KeyDescription]`	named-property
`$[].modifiedProperties[][displayName=ManagedIdentityResourceId]`	named-property
`$[].modifiedProperties[][displayName=ServicePrincipalName]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: Device · LoggedByService: Core Directory · OperationName: Update device

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "Included Updated Properties",
        "newValue": "\"VALUE_2\"",
        "oldValue": null
      },
      {
        "displayName": "IsCompliant",
        "newValue": "[false]",
        "oldValue": "[false]"
      },
      {
        "displayName": "TargetId.DeviceId",
        "newValue": "\"00000000-0000-4000-8000-000000000002\"",
        "oldValue": null
      },
      {
        "displayName": "TargetId.DeviceOSType",
        "newValue": "\"VALUE_3\"",
        "oldValue": null
      },
      {
        "displayName": "TargetId.DeviceTrustType",
        "newValue": "\"VALUE_4\"",
        "oldValue": null
      }
    ],
    "type": "VALUE_5"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	array
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].newValue::<json>[]`	boolean
`$[].modifiedProperties[].oldValue`	encoded-json
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[].oldValue`	string
`$[].modifiedProperties[].oldValue::<json>`	array
`$[].modifiedProperties[].oldValue::<json>[]`	boolean
`$[].modifiedProperties[][displayName=Included Updated Properties]`	named-property
`$[].modifiedProperties[][displayName=IsCompliant]`	named-property
`$[].modifiedProperties[][displayName=TargetId.DeviceId]`	named-property
`$[].modifiedProperties[][displayName=TargetId.DeviceOSType]`	named-property
`$[].modifiedProperties[][displayName=TargetId.DeviceTrustType]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: GroupManagement · LoggedByService: Self-service Group Management · OperationName: Settings_GetSettingsAsync

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [],
    "type": "VALUE_2"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Update application

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [],
    "type": "Application"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ProvisioningManagement · LoggedByService: Account Provisioning · OperationName: Other

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [],
    "type": "ServicePrincipal"
  },
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_2",
    "id": null,
    "modifiedProperties": [],
    "type": "VALUE_2"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	null
`$[].id`	string
`$[].modifiedProperties`	array
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: Device · LoggedByService: Core Directory · OperationName: Update device

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "Included Updated Properties",
        "newValue": "\"VALUE_2\"",
        "oldValue": null
      },
      {
        "displayName": "TargetId.DeviceId",
        "newValue": "\"00000000-0000-4000-8000-000000000002\"",
        "oldValue": null
      },
      {
        "displayName": "TargetId.DeviceOSType",
        "newValue": "\"VALUE_3\"",
        "oldValue": null
      },
      {
        "displayName": "TargetId.DeviceTrustType",
        "newValue": "\"VALUE_2\"",
        "oldValue": null
      }
    ],
    "type": "VALUE_4"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[][displayName=Included Updated Properties]`	named-property
`$[].modifiedProperties[][displayName=TargetId.DeviceId]`	named-property
`$[].modifiedProperties[][displayName=TargetId.DeviceOSType]`	named-property
`$[].modifiedProperties[][displayName=TargetId.DeviceTrustType]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Create application – Certificates and secrets management

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "Included Updated Properties",
        "newValue": "\"VALUE_2\"",
        "oldValue": null
      },
      {
        "displayName": "KeyDescription",
        "newValue": "[]",
        "oldValue": "[]"
      }
    ],
    "type": "Application"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	array
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].oldValue`	encoded-json
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[].oldValue`	string
`$[].modifiedProperties[].oldValue::<json>`	array
`$[].modifiedProperties[][displayName=Included Updated Properties]`	named-property
`$[].modifiedProperties[][displayName=KeyDescription]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Update application

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "Entitlement",
        "newValue": "[{\"ClaimValue\":\"VALUE_2\",\"Definition\":null,\"DependentMicrosoftGraphPermissions\":[],\"Description\":\"VALUE_3\",\"DirectAccessGrantTypes\":[1],\"DirectAccessPrivilegeLevel\":1,\"EntitlementCategory\":1,\"EntitlementEncodingVersion\":1,\"EntitlementId\":\"00000000-0000-4000-8000-000000000002\",\"ImpersonationAccessGrantTypes\":[],\"ImpersonationPrivilegeLevel\":1,\"IsDisabled\":false,\"IsPreauthzOnlyDirectAccessGrant\":false,\"IsPreauthzOnlyImpersonationGrant\":false,\"IsPrivate\":false,\"Name\":\"USERNAME_2\",\"Origin\":1,\"ResourceScopeType\":1,\"UserConsentDescription\":null,\"UserConsentDisplayName\":null},{\"ClaimValue\":\"VALUE_6\",\"Definition\":null,\"DependentMicrosoftGraphPermissions\":[],\"Description\":\"VALUE_7\",\"DirectAccessGrantTypes\":[],\"DirectAccessPrivilegeLevel\":1,\"EntitlementCategory\":1,\"EntitlementEncodingVersion\":1,\"EntitlementId\":\"00000000-0000-4000-8000-000000000004\",\"ImpersonationAccessGrantTypes\":[{\"Impersonated\":1,\"Impersonator\":1}],\"ImpersonationPrivilegeLevel\":1,\"IsDisabled\":false,\"IsPreauthzOnlyDirectAccessGrant\":false,\"IsPreauthzOnlyImpersonationGrant\":false,\"IsPrivate\":false,\"Name\":\"USERNAME_4\",\"Origin\":1,\"ResourceScopeType\":1,\"UserConsentDescription\":\"USERNAME_5\",\"UserConsentDisplayName\":\"USERNAME_4\"}]",
        "oldValue": "[{\"ClaimValue\":\"VALUE_2\",\"Definition\":null,\"DependentMicrosoftGraphPermissions\":[],\"Description\":\"VALUE_3\",\"DirectAccessGrantTypes\":[1],\"DirectAccessPrivilegeLevel\":1,\"EntitlementCategory\":1,\"EntitlementEncodingVersion\":1,\"EntitlementId\":\"00000000-0000-4000-8000-000000000002\",\"ImpersonationAccessGrantTypes\":[],\"ImpersonationPrivilegeLevel\":1,\"IsDisabled\":false,\"IsPreauthzOnlyDirectAccessGrant\":false,\"IsPreauthzOnlyImpersonationGrant\":false,\"IsPrivate\":false,\"Name\":\"USERNAME_2\",\"Origin\":1,\"ResourceScopeType\":1,\"UserConsentDescription\":null,\"UserConsentDisplayName\":null},{\"ClaimValue\":\"VALUE_6\",\"Definition\":null,\"DependentMicrosoftGraphPermissions\":[],\"Description\":\"VALUE_7\",\"DirectAccessGrantTypes\":[],\"DirectAccessPrivilegeLevel\":1,\"EntitlementCategory\":1,\"EntitlementEncodingVersion\":1,\"EntitlementId\":\"00000000-0000-4000-8000-000000000004\",\"ImpersonationAccessGrantTypes\":[{\"Impersonated\":1,\"Impersonator\":1}],\"ImpersonationPrivilegeLevel\":1,\"IsDisabled\":false,\"IsPreauthzOnlyDirectAccessGrant\":false,\"IsPreauthzOnlyImpersonationGrant\":false,\"IsPrivate\":false,\"Name\":\"USERNAME_4\",\"Origin\":1,\"ResourceScopeType\":1,\"UserConsentDescription\":\"USERNAME_5\",\"UserConsentDisplayName\":\"USERNAME_4\"}]"
      },
      {
        "displayName": "Included Updated Properties",
        "newValue": "\"VALUE_10\"",
        "oldValue": null
      }
    ],
    "type": "Application"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	array
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].newValue::<json>[]`	object
`$[].modifiedProperties[].newValue::<json>[].ClaimValue`	string
`$[].modifiedProperties[].newValue::<json>[].Definition`	null
`$[].modifiedProperties[].newValue::<json>[].DependentMicrosoftGraphPermissions`	array
`$[].modifiedProperties[].newValue::<json>[].Description`	string
`$[].modifiedProperties[].newValue::<json>[].DirectAccessGrantTypes`	array
`$[].modifiedProperties[].newValue::<json>[].DirectAccessGrantTypes[]`	integer
`$[].modifiedProperties[].newValue::<json>[].DirectAccessPrivilegeLevel`	integer
`$[].modifiedProperties[].newValue::<json>[].EntitlementCategory`	integer
`$[].modifiedProperties[].newValue::<json>[].EntitlementEncodingVersion`	integer
`$[].modifiedProperties[].newValue::<json>[].EntitlementId`	string
`$[].modifiedProperties[].newValue::<json>[].ImpersonationAccessGrantTypes`	array
`$[].modifiedProperties[].newValue::<json>[].ImpersonationAccessGrantTypes[]`	object
`$[].modifiedProperties[].newValue::<json>[].ImpersonationAccessGrantTypes[].Impersonated`	integer
`$[].modifiedProperties[].newValue::<json>[].ImpersonationAccessGrantTypes[].Impersonator`	integer
`$[].modifiedProperties[].newValue::<json>[].ImpersonationPrivilegeLevel`	integer
`$[].modifiedProperties[].newValue::<json>[].IsDisabled`	boolean
`$[].modifiedProperties[].newValue::<json>[].IsPreauthzOnlyDirectAccessGrant`	boolean
`$[].modifiedProperties[].newValue::<json>[].IsPreauthzOnlyImpersonationGrant`	boolean
`$[].modifiedProperties[].newValue::<json>[].IsPrivate`	boolean
`$[].modifiedProperties[].newValue::<json>[].Name`	string
`$[].modifiedProperties[].newValue::<json>[].Origin`	integer
`$[].modifiedProperties[].newValue::<json>[].ResourceScopeType`	integer
`$[].modifiedProperties[].newValue::<json>[].UserConsentDescription`	null
`$[].modifiedProperties[].newValue::<json>[].UserConsentDescription`	string
`$[].modifiedProperties[].newValue::<json>[].UserConsentDisplayName`	null
`$[].modifiedProperties[].newValue::<json>[].UserConsentDisplayName`	string
`$[].modifiedProperties[].oldValue`	encoded-json
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[].oldValue`	string
`$[].modifiedProperties[].oldValue::<json>`	array
`$[].modifiedProperties[].oldValue::<json>[]`	object
`$[].modifiedProperties[].oldValue::<json>[].ClaimValue`	string
`$[].modifiedProperties[].oldValue::<json>[].Definition`	null
`$[].modifiedProperties[].oldValue::<json>[].DependentMicrosoftGraphPermissions`	array
`$[].modifiedProperties[].oldValue::<json>[].Description`	string
`$[].modifiedProperties[].oldValue::<json>[].DirectAccessGrantTypes`	array
`$[].modifiedProperties[].oldValue::<json>[].DirectAccessGrantTypes[]`	integer
`$[].modifiedProperties[].oldValue::<json>[].DirectAccessPrivilegeLevel`	integer
`$[].modifiedProperties[].oldValue::<json>[].EntitlementCategory`	integer
`$[].modifiedProperties[].oldValue::<json>[].EntitlementEncodingVersion`	integer
`$[].modifiedProperties[].oldValue::<json>[].EntitlementId`	string
`$[].modifiedProperties[].oldValue::<json>[].ImpersonationAccessGrantTypes`	array
`$[].modifiedProperties[].oldValue::<json>[].ImpersonationAccessGrantTypes[]`	object
`$[].modifiedProperties[].oldValue::<json>[].ImpersonationAccessGrantTypes[].Impersonated`	integer
`$[].modifiedProperties[].oldValue::<json>[].ImpersonationAccessGrantTypes[].Impersonator`	integer
`$[].modifiedProperties[].oldValue::<json>[].ImpersonationPrivilegeLevel`	integer
`$[].modifiedProperties[].oldValue::<json>[].IsDisabled`	boolean
`$[].modifiedProperties[].oldValue::<json>[].IsPreauthzOnlyDirectAccessGrant`	boolean
`$[].modifiedProperties[].oldValue::<json>[].IsPreauthzOnlyImpersonationGrant`	boolean
`$[].modifiedProperties[].oldValue::<json>[].IsPrivate`	boolean
`$[].modifiedProperties[].oldValue::<json>[].Name`	string
`$[].modifiedProperties[].oldValue::<json>[].Origin`	integer
`$[].modifiedProperties[].oldValue::<json>[].ResourceScopeType`	integer
`$[].modifiedProperties[].oldValue::<json>[].UserConsentDescription`	null
`$[].modifiedProperties[].oldValue::<json>[].UserConsentDescription`	string
`$[].modifiedProperties[].oldValue::<json>[].UserConsentDisplayName`	null
`$[].modifiedProperties[].oldValue::<json>[].UserConsentDisplayName`	string
`$[].modifiedProperties[][displayName=Entitlement]`	named-property
`$[].modifiedProperties[][displayName=Included Updated Properties]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Update application

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "DisplayName",
        "newValue": "[\"VALUE_2\"]",
        "oldValue": "[\"VALUE_3\"]"
      },
      {
        "displayName": "Included Updated Properties",
        "newValue": "\"VALUE_4\"",
        "oldValue": null
      }
    ],
    "type": "Application"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	array
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].newValue::<json>[]`	string
`$[].modifiedProperties[].oldValue`	encoded-json
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[].oldValue`	string
`$[].modifiedProperties[].oldValue::<json>`	array
`$[].modifiedProperties[].oldValue::<json>[]`	string
`$[].modifiedProperties[][displayName=DisplayName]`	named-property
`$[].modifiedProperties[][displayName=Included Updated Properties]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Consent to application

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "ConsentAction.Permissions",
        "newValue": "\"VALUE_5\"",
        "oldValue": null
      },
      {
        "displayName": "ConsentContext.IsAdminConsent",
        "newValue": "\"VALUE_2\"",
        "oldValue": null
      },
      {
        "displayName": "ConsentContext.IsAppOnly",
        "newValue": "\"VALUE_3\"",
        "oldValue": null
      },
      {
        "displayName": "ConsentContext.OnBehalfOfAll",
        "newValue": "\"VALUE_2\"",
        "oldValue": null
      },
      {
        "displayName": "ConsentContext.Tags",
        "newValue": "\"VALUE_4\"",
        "oldValue": null
      }
    ],
    "type": "ServicePrincipal"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[][displayName=ConsentAction.Permissions]`	named-property
`$[].modifiedProperties[][displayName=ConsentContext.IsAdminConsent]`	named-property
`$[].modifiedProperties[][displayName=ConsentContext.IsAppOnly]`	named-property
`$[].modifiedProperties[][displayName=ConsentContext.OnBehalfOfAll]`	named-property
`$[].modifiedProperties[][displayName=ConsentContext.Tags]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Add application

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "AppId",
        "newValue": "[\"00000000-0000-4000-8000-000000000002\"]",
        "oldValue": "[]"
      },
      {
        "displayName": "DisplayName",
        "newValue": "[\"VALUE_2\"]",
        "oldValue": "[]"
      },
      {
        "displayName": "EXAMPLE_LABEL_001",
        "newValue": "[false]",
        "oldValue": "[]"
      },
      {
        "displayName": "EXAMPLE_LABEL_002",
        "newValue": "[false]",
        "oldValue": "[]"
      },
      {
        "displayName": "EXAMPLE_LABEL_003",
        "newValue": "[\"VALUE_3\"]",
        "oldValue": "[]"
      },
      {
        "displayName": "EXAMPLE_LABEL_004",
        "newValue": "[{\"AllProperties\":false,\"CredentialsWithUsageSign\":null,\"CredentialsWithUsageVerify\":null,\"IdentifierUris\":null,\"IsEnabled\":false,\"ServicePrincipalLockExtension\":\"VALUE_4\",\"TokenEncryptionKeyId\":null}]",
        "oldValue": "[]"
      },
      {
        "displayName": "EXAMPLE_LABEL_005",
        "newValue": "[\"VALUE_5\"]",
        "oldValue": "[]"
      },
      {
        "displayName": "Included Updated Properties",
        "newValue": "\"VALUE_6\"",
        "oldValue": null
      }
    ],
    "type": "Application"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	array
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].newValue::<json>[]`	boolean
`$[].modifiedProperties[].newValue::<json>[]`	object
`$[].modifiedProperties[].newValue::<json>[]`	string
`$[].modifiedProperties[].newValue::<json>[].AllProperties`	boolean
`$[].modifiedProperties[].newValue::<json>[].CredentialsWithUsageSign`	null
`$[].modifiedProperties[].newValue::<json>[].CredentialsWithUsageVerify`	null
`$[].modifiedProperties[].newValue::<json>[].IdentifierUris`	null
`$[].modifiedProperties[].newValue::<json>[].IsEnabled`	boolean
`$[].modifiedProperties[].newValue::<json>[].ServicePrincipalLockExtension`	string
`$[].modifiedProperties[].newValue::<json>[].TokenEncryptionKeyId`	null
`$[].modifiedProperties[].oldValue`	encoded-json
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[].oldValue`	string
`$[].modifiedProperties[].oldValue::<json>`	array
`$[].modifiedProperties[][displayName=AppId]`	named-property
`$[].modifiedProperties[][displayName=DisplayName]`	named-property
`$[].modifiedProperties[][displayName=EXAMPLE_LABEL_001]`	named-property
`$[].modifiedProperties[][displayName=EXAMPLE_LABEL_002]`	named-property
`$[].modifiedProperties[][displayName=EXAMPLE_LABEL_003]`	named-property
`$[].modifiedProperties[][displayName=EXAMPLE_LABEL_004]`	named-property
`$[].modifiedProperties[][displayName=EXAMPLE_LABEL_005]`	named-property
`$[].modifiedProperties[][displayName=Included Updated Properties]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Update application

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "Included Updated Properties",
        "newValue": "\"VALUE_2\"",
        "oldValue": null
      },
      {
        "displayName": "RequiredResourceAccess",
        "newValue": "[{\"EncodingVersion\":1,\"RequiredAppPermissions\":[{\"DirectAccessGrant\":false,\"EntitlementId\":\"00000000-0000-4000-8000-000000000002\",\"ImpersonationAccessGrants\":[]}],\"ResourceAppId\":\"00000000-0000-4000-8000-000000000003\"}]",
        "oldValue": "[]"
      }
    ],
    "type": "Application"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	array
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].newValue::<json>[]`	object
`$[].modifiedProperties[].newValue::<json>[].EncodingVersion`	integer
`$[].modifiedProperties[].newValue::<json>[].RequiredAppPermissions`	array
`$[].modifiedProperties[].newValue::<json>[].RequiredAppPermissions[]`	object
`$[].modifiedProperties[].newValue::<json>[].RequiredAppPermissions[].DirectAccessGrant`	boolean
`$[].modifiedProperties[].newValue::<json>[].RequiredAppPermissions[].EntitlementId`	string
`$[].modifiedProperties[].newValue::<json>[].RequiredAppPermissions[].ImpersonationAccessGrants`	array
`$[].modifiedProperties[].newValue::<json>[].ResourceAppId`	string
`$[].modifiedProperties[].oldValue`	encoded-json
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[].oldValue`	string
`$[].modifiedProperties[].oldValue::<json>`	array
`$[].modifiedProperties[][displayName=Included Updated Properties]`	named-property
`$[].modifiedProperties[][displayName=RequiredResourceAccess]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ProvisioningManagement · LoggedByService: Account Provisioning · OperationName: Synchronization rule action

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "00000000-0000-4000-8000-000000000002",
    "groupType": "VALUE_7",
    "id": null,
    "modifiedProperties": [],
    "type": "Group"
  },
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "EXAMPLE_LABEL_001",
        "newValue": "\"00000000-0000-4000-8000-000000000003\"",
        "oldValue": null
      },
      {
        "displayName": "IsSoftDeleted",
        "newValue": "\"VALUE_5\"",
        "oldValue": null
      },
      {
        "displayName": "description",
        "newValue": "\"VALUE_2\"",
        "oldValue": null
      },
      {
        "displayName": "dirSyncEnabled",
        "newValue": "\"VALUE_3\"",
        "oldValue": null
      },
      {
        "displayName": "displayName",
        "newValue": "\"VALUE_4\"",
        "oldValue": null
      },
      {
        "displayName": "mailEnabled",
        "newValue": "\"VALUE_5\"",
        "oldValue": null
      },
      {
        "displayName": "objectId",
        "newValue": "\"00000000-0000-4000-8000-000000000002\"",
        "oldValue": null
      },
      {
        "displayName": "onPremisesObjectIdentifier",
        "newValue": "\"VALUE_3\"",
        "oldValue": null
      },
      {
        "displayName": "securityEnabled",
        "newValue": "\"VALUE_6\"",
        "oldValue": null
      }
    ],
    "type": "ServicePrincipal"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].groupType`	string
`$[].id`	null
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[][displayName=EXAMPLE_LABEL_001]`	named-property
`$[].modifiedProperties[][displayName=IsSoftDeleted]`	named-property
`$[].modifiedProperties[][displayName=description]`	named-property
`$[].modifiedProperties[][displayName=dirSyncEnabled]`	named-property
`$[].modifiedProperties[][displayName=displayName]`	named-property
`$[].modifiedProperties[][displayName=mailEnabled]`	named-property
`$[].modifiedProperties[][displayName=objectId]`	named-property
`$[].modifiedProperties[][displayName=onPremisesObjectIdentifier]`	named-property
`$[].modifiedProperties[][displayName=securityEnabled]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Add delegated permission grant

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "EXAMPLE_LABEL_001",
        "newValue": "\"VALUE_3\"",
        "oldValue": null
      },
      {
        "displayName": "EXAMPLE_LABEL_002",
        "newValue": "\"00000000-0000-4000-8000-000000000002\"",
        "oldValue": null
      },
      {
        "displayName": "EXAMPLE_LABEL_003",
        "newValue": "\"VALUE_2\"",
        "oldValue": null
      },
      {
        "displayName": "ServicePrincipal.AppId",
        "newValue": null,
        "oldValue": null
      },
      {
        "displayName": "ServicePrincipal.DisplayName",
        "newValue": null,
        "oldValue": null
      },
      {
        "displayName": "ServicePrincipal.Name",
        "newValue": null,
        "oldValue": null
      },
      {
        "displayName": "ServicePrincipal.ObjectID",
        "newValue": "\"00000000-0000-4000-8000-000000000003\"",
        "oldValue": null
      },
      {
        "displayName": "TargetId.ServicePrincipalNames",
        "newValue": "\"VALUE_4\"",
        "oldValue": null
      }
    ],
    "type": "ServicePrincipal"
  },
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": null,
    "id": "00000000-0000-4000-8000-000000000003",
    "modifiedProperties": [],
    "type": "ServicePrincipal"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	null
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	null
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[][displayName=EXAMPLE_LABEL_001]`	named-property
`$[].modifiedProperties[][displayName=EXAMPLE_LABEL_002]`	named-property
`$[].modifiedProperties[][displayName=EXAMPLE_LABEL_003]`	named-property
`$[].modifiedProperties[][displayName=ServicePrincipal.AppId]`	named-property
`$[].modifiedProperties[][displayName=ServicePrincipal.DisplayName]`	named-property
`$[].modifiedProperties[][displayName=ServicePrincipal.Name]`	named-property
`$[].modifiedProperties[][displayName=ServicePrincipal.ObjectID]`	named-property
`$[].modifiedProperties[][displayName=TargetId.ServicePrincipalNames]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Add application

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "AppAddress",
        "newValue": "[{\"Address\":\"https://example.invalid/SAMPLE_1\",\"AddressType\":1,\"IsReplyAddressDefault\":false,\"ReplyAddressClientType\":1,\"ReplyAddressIndex\":null}]",
        "oldValue": "[]"
      },
      {
        "displayName": "AppId",
        "newValue": "[\"00000000-0000-4000-8000-000000000002\"]",
        "oldValue": "[]"
      },
      {
        "displayName": "DisplayName",
        "newValue": "[\"VALUE_2\"]",
        "oldValue": "[]"
      },
      {
        "displayName": "EXAMPLE_LABEL_001",
        "newValue": "[false]",
        "oldValue": "[]"
      },
      {
        "displayName": "EXAMPLE_LABEL_002",
        "newValue": "[\"VALUE_3\"]",
        "oldValue": "[]"
      },
      {
        "displayName": "EXAMPLE_LABEL_003",
        "newValue": "[{\"AllProperties\":false,\"CredentialsWithUsageSign\":false,\"CredentialsWithUsageVerify\":false,\"IdentifierUris\":false,\"IsEnabled\":false,\"ServicePrincipalLockExtension\":\"VALUE_4\",\"TokenEncryptionKeyId\":false}]",
        "oldValue": "[]"
      },
      {
        "displayName": "EXAMPLE_LABEL_004",
        "newValue": "[\"VALUE_5\"]",
        "oldValue": "[]"
      },
      {
        "displayName": "Included Updated Properties",
        "newValue": "\"VALUE_6\"",
        "oldValue": null
      },
      {
        "displayName": "RequiredResourceAccess",
        "newValue": "[{\"EncodingVersion\":1,\"RequiredAppPermissions\":[{\"DirectAccessGrant\":false,\"EntitlementId\":\"00000000-0000-4000-8000-000000000003\",\"ImpersonationAccessGrants\":[1]}],\"ResourceAppId\":\"00000000-0000-4000-8000-000000000004\"}]",
        "oldValue": "[]"
      }
    ],
    "type": "Application"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	array
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].newValue::<json>[]`	boolean
`$[].modifiedProperties[].newValue::<json>[]`	object
`$[].modifiedProperties[].newValue::<json>[]`	string
`$[].modifiedProperties[].newValue::<json>[].Address`	string
`$[].modifiedProperties[].newValue::<json>[].AddressType`	integer
`$[].modifiedProperties[].newValue::<json>[].AllProperties`	boolean
`$[].modifiedProperties[].newValue::<json>[].CredentialsWithUsageSign`	boolean
`$[].modifiedProperties[].newValue::<json>[].CredentialsWithUsageVerify`	boolean
`$[].modifiedProperties[].newValue::<json>[].EncodingVersion`	integer
`$[].modifiedProperties[].newValue::<json>[].IdentifierUris`	boolean
`$[].modifiedProperties[].newValue::<json>[].IsEnabled`	boolean
`$[].modifiedProperties[].newValue::<json>[].IsReplyAddressDefault`	boolean
`$[].modifiedProperties[].newValue::<json>[].ReplyAddressClientType`	integer
`$[].modifiedProperties[].newValue::<json>[].ReplyAddressIndex`	null
`$[].modifiedProperties[].newValue::<json>[].RequiredAppPermissions`	array
`$[].modifiedProperties[].newValue::<json>[].RequiredAppPermissions[]`	object
`$[].modifiedProperties[].newValue::<json>[].RequiredAppPermissions[].DirectAccessGrant`	boolean
`$[].modifiedProperties[].newValue::<json>[].RequiredAppPermissions[].EntitlementId`	string
`$[].modifiedProperties[].newValue::<json>[].RequiredAppPermissions[].ImpersonationAccessGrants`	array
`$[].modifiedProperties[].newValue::<json>[].RequiredAppPermissions[].ImpersonationAccessGrants[]`	integer
`$[].modifiedProperties[].newValue::<json>[].ResourceAppId`	string
`$[].modifiedProperties[].newValue::<json>[].ServicePrincipalLockExtension`	string
`$[].modifiedProperties[].newValue::<json>[].TokenEncryptionKeyId`	boolean
`$[].modifiedProperties[].oldValue`	encoded-json
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[].oldValue`	string
`$[].modifiedProperties[].oldValue::<json>`	array
`$[].modifiedProperties[][displayName=AppAddress]`	named-property
`$[].modifiedProperties[][displayName=AppId]`	named-property
`$[].modifiedProperties[][displayName=DisplayName]`	named-property
`$[].modifiedProperties[][displayName=EXAMPLE_LABEL_001]`	named-property
`$[].modifiedProperties[][displayName=EXAMPLE_LABEL_002]`	named-property
`$[].modifiedProperties[][displayName=EXAMPLE_LABEL_003]`	named-property
`$[].modifiedProperties[][displayName=EXAMPLE_LABEL_004]`	named-property
`$[].modifiedProperties[][displayName=Included Updated Properties]`	named-property
`$[].modifiedProperties[][displayName=RequiredResourceAccess]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: UserManagement · LoggedByService: Core Directory · OperationName: Update user

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": null,
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "EXAMPLE_LABEL_001",
        "newValue": "[\"VALUE_2\"]",
        "oldValue": "[\"VALUE_3\"]"
      },
      {
        "displayName": "Included Updated Properties",
        "newValue": "\"VALUE_4\"",
        "oldValue": null
      },
      {
        "displayName": "TargetId.UserType",
        "newValue": "\"VALUE_5\"",
        "oldValue": null
      }
    ],
    "type": "User",
    "userPrincipalName": "USERNAME_1@example.invalid"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	null
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	array
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].newValue::<json>[]`	string
`$[].modifiedProperties[].oldValue`	encoded-json
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[].oldValue`	string
`$[].modifiedProperties[].oldValue::<json>`	array
`$[].modifiedProperties[].oldValue::<json>[]`	string
`$[].modifiedProperties[][displayName=EXAMPLE_LABEL_001]`	named-property
`$[].modifiedProperties[][displayName=Included Updated Properties]`	named-property
`$[].modifiedProperties[][displayName=TargetId.UserType]`	named-property
`$[].type`	string
`$[].userPrincipalName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Add delegated permission grant

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "EXAMPLE_LABEL_001",
        "newValue": "\"VALUE_3\"",
        "oldValue": null
      },
      {
        "displayName": "EXAMPLE_LABEL_002",
        "newValue": "\"VALUE_2\"",
        "oldValue": null
      },
      {
        "displayName": "ServicePrincipal.AppId",
        "newValue": null,
        "oldValue": null
      },
      {
        "displayName": "ServicePrincipal.DisplayName",
        "newValue": null,
        "oldValue": null
      },
      {
        "displayName": "ServicePrincipal.Name",
        "newValue": null,
        "oldValue": null
      },
      {
        "displayName": "ServicePrincipal.ObjectID",
        "newValue": "\"00000000-0000-4000-8000-000000000002\"",
        "oldValue": null
      },
      {
        "displayName": "TargetId.ServicePrincipalNames",
        "newValue": "\"VALUE_4\"",
        "oldValue": null
      }
    ],
    "type": "ServicePrincipal"
  },
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": null,
    "id": "00000000-0000-4000-8000-000000000002",
    "modifiedProperties": [],
    "type": "ServicePrincipal"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	null
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	null
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[][displayName=EXAMPLE_LABEL_001]`	named-property
`$[].modifiedProperties[][displayName=EXAMPLE_LABEL_002]`	named-property
`$[].modifiedProperties[][displayName=ServicePrincipal.AppId]`	named-property
`$[].modifiedProperties[][displayName=ServicePrincipal.DisplayName]`	named-property
`$[].modifiedProperties[][displayName=ServicePrincipal.Name]`	named-property
`$[].modifiedProperties[][displayName=ServicePrincipal.ObjectID]`	named-property
`$[].modifiedProperties[][displayName=TargetId.ServicePrincipalNames]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: GroupManagement · LoggedByService: Self-service Group Management · OperationName: GroupsODataV4_Get

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [],
    "type": "VALUE_2"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: Device · LoggedByService: Core Directory · OperationName: Update device

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "CloudDeviceOSVersion",
        "newValue": "[\"VALUE_2\"]",
        "oldValue": "[\"1.5\"]"
      },
      {
        "displayName": "DeviceOSVersion",
        "newValue": "[\"VALUE_2\"]",
        "oldValue": "[\"1.5\"]"
      },
      {
        "displayName": "Included Updated Properties",
        "newValue": "\"VALUE_3\"",
        "oldValue": null
      },
      {
        "displayName": "TargetId.DeviceId",
        "newValue": "\"00000000-0000-4000-8000-000000000002\"",
        "oldValue": null
      },
      {
        "displayName": "TargetId.DeviceOSType",
        "newValue": "\"VALUE_4\"",
        "oldValue": null
      },
      {
        "displayName": "TargetId.DeviceTrustType",
        "newValue": "\"VALUE_5\"",
        "oldValue": null
      }
    ],
    "type": "VALUE_6"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	array
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].newValue::<json>[]`	string
`$[].modifiedProperties[].oldValue`	encoded-json
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[].oldValue`	string
`$[].modifiedProperties[].oldValue::<json>`	array
`$[].modifiedProperties[].oldValue::<json>[]`	encoded-json
`$[].modifiedProperties[].oldValue::<json>[]`	string
`$[].modifiedProperties[].oldValue::<json>[]::<json>`	number
`$[].modifiedProperties[][displayName=CloudDeviceOSVersion]`	named-property
`$[].modifiedProperties[][displayName=DeviceOSVersion]`	named-property
`$[].modifiedProperties[][displayName=Included Updated Properties]`	named-property
`$[].modifiedProperties[][displayName=TargetId.DeviceId]`	named-property
`$[].modifiedProperties[][displayName=TargetId.DeviceOSType]`	named-property
`$[].modifiedProperties[][displayName=TargetId.DeviceTrustType]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Add service principal credentials

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "Included Updated Properties",
        "newValue": "\"VALUE_4\"",
        "oldValue": null
      },
      {
        "displayName": "KeyDescription",
        "newValue": "[\"VALUE_2\"]",
        "oldValue": "[\"VALUE_2\"]"
      }
    ],
    "type": "ServicePrincipal"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	array
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].newValue::<json>[]`	string
`$[].modifiedProperties[].oldValue`	encoded-json
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[].oldValue`	string
`$[].modifiedProperties[].oldValue::<json>`	array
`$[].modifiedProperties[].oldValue::<json>[]`	string
`$[].modifiedProperties[][displayName=Included Updated Properties]`	named-property
`$[].modifiedProperties[][displayName=KeyDescription]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ProvisioningManagement · LoggedByService: Account Provisioning · OperationName: Execution

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [],
    "type": "ServicePrincipal"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Update application

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "EXAMPLE_LABEL_001",
        "newValue": "[\"VALUE_2\"]",
        "oldValue": "[]"
      },
      {
        "displayName": "Included Updated Properties",
        "newValue": "\"VALUE_3\"",
        "oldValue": null
      }
    ],
    "type": "Application"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	array
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].newValue::<json>[]`	string
`$[].modifiedProperties[].oldValue`	encoded-json
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[].oldValue`	string
`$[].modifiedProperties[].oldValue::<json>`	array
`$[].modifiedProperties[][displayName=EXAMPLE_LABEL_001]`	named-property
`$[].modifiedProperties[][displayName=Included Updated Properties]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: UserManagement · LoggedByService: Core Directory · OperationName: Update user

All values in this example are synthetic. Format: JSON; column encoding: native-json.

[
  {
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "DisplayName",
        "newValue": "\"VALUE_1\"",
        "oldValue": "\"VALUE_2\""
      }
    ],
    "type": "User",
    "userPrincipalName": "USERNAME_1@example.invalid"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].oldValue`	encoded-json
`$[].modifiedProperties[].oldValue`	string
`$[].modifiedProperties[].oldValue::<json>`	string
`$[].modifiedProperties[][displayName=DisplayName]`	named-property
`$[].type`	string
`$[].userPrincipalName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Update application

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "FederatedIdentityCredentials",
        "newValue": "[{\"Audiences\":[\"VALUE_2\"],\"ClaimsMatchingExpressionLanguageVersion\":1,\"ClaimsMatchingExpressionValue\":null,\"Description\":\"VALUE_3\",\"EncodingVersion\":1,\"Id\":\"00000000-0000-4000-8000-000000000002\",\"Issuer\":\"https://example.invalid/SAMPLE_1\",\"Name\":\"USERNAME_2\",\"Subject\":\"00000000-0000-4000-8000-000000000003\",\"TrustedIssuer\":null}]",
        "oldValue": "[{\"Audiences\":[\"VALUE_2\"],\"ClaimsMatchingExpressionLanguageVersion\":1,\"ClaimsMatchingExpressionValue\":null,\"Description\":\"VALUE_3\",\"EncodingVersion\":1,\"Id\":\"00000000-0000-4000-8000-000000000002\",\"Issuer\":\"https://example.invalid/SAMPLE_1\",\"Name\":\"USERNAME_2\",\"Subject\":\"00000000-0000-4000-8000-000000000003\",\"TrustedIssuer\":null}]"
      },
      {
        "displayName": "Included Updated Properties",
        "newValue": "\"VALUE_4\"",
        "oldValue": null
      }
    ],
    "type": "Application"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	array
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].newValue::<json>[]`	object
`$[].modifiedProperties[].newValue::<json>[].Audiences`	array
`$[].modifiedProperties[].newValue::<json>[].Audiences[]`	string
`$[].modifiedProperties[].newValue::<json>[].ClaimsMatchingExpressionLanguageVersion`	integer
`$[].modifiedProperties[].newValue::<json>[].ClaimsMatchingExpressionValue`	null
`$[].modifiedProperties[].newValue::<json>[].Description`	string
`$[].modifiedProperties[].newValue::<json>[].EncodingVersion`	integer
`$[].modifiedProperties[].newValue::<json>[].Id`	string
`$[].modifiedProperties[].newValue::<json>[].Issuer`	string
`$[].modifiedProperties[].newValue::<json>[].Name`	string
`$[].modifiedProperties[].newValue::<json>[].Subject`	string
`$[].modifiedProperties[].newValue::<json>[].TrustedIssuer`	null
`$[].modifiedProperties[].oldValue`	encoded-json
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[].oldValue`	string
`$[].modifiedProperties[].oldValue::<json>`	array
`$[].modifiedProperties[].oldValue::<json>[]`	object
`$[].modifiedProperties[].oldValue::<json>[].Audiences`	array
`$[].modifiedProperties[].oldValue::<json>[].Audiences[]`	string
`$[].modifiedProperties[].oldValue::<json>[].ClaimsMatchingExpressionLanguageVersion`	integer
`$[].modifiedProperties[].oldValue::<json>[].ClaimsMatchingExpressionValue`	null
`$[].modifiedProperties[].oldValue::<json>[].Description`	string
`$[].modifiedProperties[].oldValue::<json>[].EncodingVersion`	integer
`$[].modifiedProperties[].oldValue::<json>[].Id`	string
`$[].modifiedProperties[].oldValue::<json>[].Issuer`	string
`$[].modifiedProperties[].oldValue::<json>[].Name`	string
`$[].modifiedProperties[].oldValue::<json>[].Subject`	string
`$[].modifiedProperties[].oldValue::<json>[].TrustedIssuer`	null
`$[].modifiedProperties[][displayName=FederatedIdentityCredentials]`	named-property
`$[].modifiedProperties[][displayName=Included Updated Properties]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ProvisioningManagement · LoggedByService: Account Provisioning · OperationName: Synchronization rule action

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "00000000-0000-4000-8000-000000000002",
    "groupType": "VALUE_6",
    "id": null,
    "modifiedProperties": [],
    "type": "Group"
  },
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "IsSoftDeleted",
        "newValue": "\"VALUE_3\"",
        "oldValue": null
      },
      {
        "displayName": "description",
        "newValue": "\"VALUE_2\"",
        "oldValue": null
      },
      {
        "displayName": "dirSyncEnabled",
        "newValue": "\"VALUE_2\"",
        "oldValue": null
      },
      {
        "displayName": "displayName",
        "newValue": "\"VALUE_4\"",
        "oldValue": null
      },
      {
        "displayName": "mailEnabled",
        "newValue": "\"VALUE_3\"",
        "oldValue": null
      },
      {
        "displayName": "objectId",
        "newValue": "\"00000000-0000-4000-8000-000000000002\"",
        "oldValue": null
      },
      {
        "displayName": "onPremisesObjectIdentifier",
        "newValue": "\"VALUE_2\"",
        "oldValue": null
      },
      {
        "displayName": "securityEnabled",
        "newValue": "\"VALUE_5\"",
        "oldValue": null
      }
    ],
    "type": "ServicePrincipal"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].groupType`	string
`$[].id`	null
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[][displayName=IsSoftDeleted]`	named-property
`$[].modifiedProperties[][displayName=description]`	named-property
`$[].modifiedProperties[][displayName=dirSyncEnabled]`	named-property
`$[].modifiedProperties[][displayName=displayName]`	named-property
`$[].modifiedProperties[][displayName=mailEnabled]`	named-property
`$[].modifiedProperties[][displayName=objectId]`	named-property
`$[].modifiedProperties[][displayName=onPremisesObjectIdentifier]`	named-property
`$[].modifiedProperties[][displayName=securityEnabled]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Update service principal

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [],
    "type": "ServicePrincipal"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Update application

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "Included Updated Properties",
        "newValue": "\"VALUE_2\"",
        "oldValue": null
      },
      {
        "displayName": "RequiredResourceAccess",
        "newValue": "[{\"EncodingVersion\":1,\"RequiredAppPermissions\":[{\"DirectAccessGrant\":false,\"EntitlementId\":\"00000000-0000-4000-8000-000000000002\",\"ImpersonationAccessGrants\":[]}],\"ResourceAppId\":\"00000000-0000-4000-8000-000000000003\"}]",
        "oldValue": "[{\"EncodingVersion\":1,\"RequiredAppPermissions\":[{\"DirectAccessGrant\":false,\"EntitlementId\":\"00000000-0000-4000-8000-000000000002\",\"ImpersonationAccessGrants\":[]}],\"ResourceAppId\":\"00000000-0000-4000-8000-000000000003\"}]"
      }
    ],
    "type": "Application"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	array
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].newValue::<json>[]`	object
`$[].modifiedProperties[].newValue::<json>[].EncodingVersion`	integer
`$[].modifiedProperties[].newValue::<json>[].RequiredAppPermissions`	array
`$[].modifiedProperties[].newValue::<json>[].RequiredAppPermissions[]`	object
`$[].modifiedProperties[].newValue::<json>[].RequiredAppPermissions[].DirectAccessGrant`	boolean
`$[].modifiedProperties[].newValue::<json>[].RequiredAppPermissions[].EntitlementId`	string
`$[].modifiedProperties[].newValue::<json>[].RequiredAppPermissions[].ImpersonationAccessGrants`	array
`$[].modifiedProperties[].newValue::<json>[].ResourceAppId`	string
`$[].modifiedProperties[].oldValue`	encoded-json
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[].oldValue`	string
`$[].modifiedProperties[].oldValue::<json>`	array
`$[].modifiedProperties[].oldValue::<json>[]`	object
`$[].modifiedProperties[].oldValue::<json>[].EncodingVersion`	integer
`$[].modifiedProperties[].oldValue::<json>[].RequiredAppPermissions`	array
`$[].modifiedProperties[].oldValue::<json>[].RequiredAppPermissions[]`	object
`$[].modifiedProperties[].oldValue::<json>[].RequiredAppPermissions[].DirectAccessGrant`	boolean
`$[].modifiedProperties[].oldValue::<json>[].RequiredAppPermissions[].EntitlementId`	string
`$[].modifiedProperties[].oldValue::<json>[].RequiredAppPermissions[].ImpersonationAccessGrants`	array
`$[].modifiedProperties[].oldValue::<json>[].ResourceAppId`	string
`$[].modifiedProperties[][displayName=Included Updated Properties]`	named-property
`$[].modifiedProperties[][displayName=RequiredResourceAccess]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: Device · LoggedByService: Core Directory · OperationName: Update device

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "CloudDeviceOSVersion",
        "newValue": "[\"1.5\"]",
        "oldValue": "[\"VALUE_2\"]"
      },
      {
        "displayName": "DeviceOSVersion",
        "newValue": "[\"1.5\"]",
        "oldValue": "[\"VALUE_2\"]"
      },
      {
        "displayName": "Included Updated Properties",
        "newValue": "\"VALUE_3\"",
        "oldValue": null
      },
      {
        "displayName": "TargetId.DeviceId",
        "newValue": "\"00000000-0000-4000-8000-000000000002\"",
        "oldValue": null
      },
      {
        "displayName": "TargetId.DeviceOSType",
        "newValue": "\"VALUE_4\"",
        "oldValue": null
      },
      {
        "displayName": "TargetId.DeviceTrustType",
        "newValue": "\"VALUE_5\"",
        "oldValue": null
      }
    ],
    "type": "VALUE_6"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	array
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].newValue::<json>[]`	encoded-json
`$[].modifiedProperties[].newValue::<json>[]`	string
`$[].modifiedProperties[].newValue::<json>[]::<json>`	number
`$[].modifiedProperties[].oldValue`	encoded-json
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[].oldValue`	string
`$[].modifiedProperties[].oldValue::<json>`	array
`$[].modifiedProperties[].oldValue::<json>[]`	string
`$[].modifiedProperties[][displayName=CloudDeviceOSVersion]`	named-property
`$[].modifiedProperties[][displayName=DeviceOSVersion]`	named-property
`$[].modifiedProperties[][displayName=Included Updated Properties]`	named-property
`$[].modifiedProperties[][displayName=TargetId.DeviceId]`	named-property
`$[].modifiedProperties[][displayName=TargetId.DeviceOSType]`	named-property
`$[].modifiedProperties[][displayName=TargetId.DeviceTrustType]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: GroupManagement · LoggedByService: Self-service Group Management · OperationName: Group_GetDynamicGroupProperties

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "groupType": "VALUE_2",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [],
    "type": "Group"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].groupType`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Update application

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "AppAddress",
        "newValue": "[{\"Address\":\"https://example.invalid/SAMPLE_1\",\"AddressType\":1,\"IsReplyAddressDefault\":false,\"ReplyAddressClientType\":1,\"ReplyAddressIndex\":null}]",
        "oldValue": "[{\"Address\":\"https://example.invalid/SAMPLE_2\",\"AddressType\":1,\"IsReplyAddressDefault\":false,\"ReplyAddressClientType\":1,\"ReplyAddressIndex\":null}]"
      },
      {
        "displayName": "Included Updated Properties",
        "newValue": "\"VALUE_2\"",
        "oldValue": null
      }
    ],
    "type": "Application"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	array
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].newValue::<json>[]`	object
`$[].modifiedProperties[].newValue::<json>[].Address`	string
`$[].modifiedProperties[].newValue::<json>[].AddressType`	integer
`$[].modifiedProperties[].newValue::<json>[].IsReplyAddressDefault`	boolean
`$[].modifiedProperties[].newValue::<json>[].ReplyAddressClientType`	integer
`$[].modifiedProperties[].newValue::<json>[].ReplyAddressIndex`	null
`$[].modifiedProperties[].oldValue`	encoded-json
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[].oldValue`	string
`$[].modifiedProperties[].oldValue::<json>`	array
`$[].modifiedProperties[].oldValue::<json>[]`	object
`$[].modifiedProperties[].oldValue::<json>[].Address`	string
`$[].modifiedProperties[].oldValue::<json>[].AddressType`	integer
`$[].modifiedProperties[].oldValue::<json>[].IsReplyAddressDefault`	boolean
`$[].modifiedProperties[].oldValue::<json>[].ReplyAddressClientType`	integer
`$[].modifiedProperties[].oldValue::<json>[].ReplyAddressIndex`	null
`$[].modifiedProperties[][displayName=AppAddress]`	named-property
`$[].modifiedProperties[][displayName=Included Updated Properties]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: UserManagement · LoggedByService: Core Directory · OperationName: Add app role assignment grant to user

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "AppRole.DisplayName",
        "newValue": "\"VALUE_2\"",
        "oldValue": null
      },
      {
        "displayName": "AppRole.Id",
        "newValue": "\"00000000-0000-4000-8000-000000000002\"",
        "oldValue": null
      },
      {
        "displayName": "AppRole.Value",
        "newValue": "\"VALUE_2\"",
        "oldValue": null
      },
      {
        "displayName": "AppRoleAssignment.CreatedDateTime",
        "newValue": "\"VALUE_3\"",
        "oldValue": null
      },
      {
        "displayName": "AppRoleAssignment.LastModifiedDateTime",
        "newValue": "\"VALUE_3\"",
        "oldValue": null
      },
      {
        "displayName": "EXAMPLE_LABEL_001",
        "newValue": "\"00000000-0000-4000-8000-000000000003\"",
        "oldValue": null
      },
      {
        "displayName": "EXAMPLE_LABEL_002",
        "newValue": "\"VALUE_4\"",
        "oldValue": null
      },
      {
        "displayName": "EXAMPLE_LABEL_003",
        "newValue": "\"USERNAME_1@example.invalid\"",
        "oldValue": null
      },
      {
        "displayName": "TargetId.ServicePrincipalNames",
        "newValue": "\"00000000-0000-4000-8000-000000000004\"",
        "oldValue": null
      }
    ],
    "type": "ServicePrincipal"
  },
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": null,
    "id": "00000000-0000-4000-8000-000000000003",
    "modifiedProperties": [],
    "type": "User",
    "userPrincipalName": "USERNAME_1@example.invalid"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	null
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[][displayName=AppRole.DisplayName]`	named-property
`$[].modifiedProperties[][displayName=AppRole.Id]`	named-property
`$[].modifiedProperties[][displayName=AppRole.Value]`	named-property
`$[].modifiedProperties[][displayName=AppRoleAssignment.CreatedDateTime]`	named-property
`$[].modifiedProperties[][displayName=AppRoleAssignment.LastModifiedDateTime]`	named-property
`$[].modifiedProperties[][displayName=EXAMPLE_LABEL_001]`	named-property
`$[].modifiedProperties[][displayName=EXAMPLE_LABEL_002]`	named-property
`$[].modifiedProperties[][displayName=EXAMPLE_LABEL_003]`	named-property
`$[].modifiedProperties[][displayName=TargetId.ServicePrincipalNames]`	named-property
`$[].type`	string
`$[].userPrincipalName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Update application

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "FederatedIdentityCredentials",
        "newValue": "[{\"Audiences\":[\"VALUE_2\"],\"ClaimsMatchingExpressionLanguageVersion\":1,\"ClaimsMatchingExpressionValue\":null,\"Description\":null,\"EncodingVersion\":1,\"Id\":\"00000000-0000-4000-8000-000000000002\",\"Issuer\":\"https://example.invalid/SAMPLE_1\",\"Name\":\"USERNAME_2\",\"Subject\":\"00000000-0000-4000-8000-000000000003\",\"TrustedIssuer\":null}]",
        "oldValue": "[]"
      },
      {
        "displayName": "Included Updated Properties",
        "newValue": "\"VALUE_3\"",
        "oldValue": null
      }
    ],
    "type": "Application"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	array
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].newValue::<json>[]`	object
`$[].modifiedProperties[].newValue::<json>[].Audiences`	array
`$[].modifiedProperties[].newValue::<json>[].Audiences[]`	string
`$[].modifiedProperties[].newValue::<json>[].ClaimsMatchingExpressionLanguageVersion`	integer
`$[].modifiedProperties[].newValue::<json>[].ClaimsMatchingExpressionValue`	null
`$[].modifiedProperties[].newValue::<json>[].Description`	null
`$[].modifiedProperties[].newValue::<json>[].EncodingVersion`	integer
`$[].modifiedProperties[].newValue::<json>[].Id`	string
`$[].modifiedProperties[].newValue::<json>[].Issuer`	string
`$[].modifiedProperties[].newValue::<json>[].Name`	string
`$[].modifiedProperties[].newValue::<json>[].Subject`	string
`$[].modifiedProperties[].newValue::<json>[].TrustedIssuer`	null
`$[].modifiedProperties[].oldValue`	encoded-json
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[].oldValue`	string
`$[].modifiedProperties[].oldValue::<json>`	array
`$[].modifiedProperties[][displayName=FederatedIdentityCredentials]`	named-property
`$[].modifiedProperties[][displayName=Included Updated Properties]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ProvisioningManagement · LoggedByService: Account Provisioning · OperationName: Other

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "00000000-0000-4000-8000-000000000002",
    "id": null,
    "modifiedProperties": [],
    "type": "VALUE_3"
  },
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "member",
        "newValue": "\"VALUE_2\"",
        "oldValue": null
      }
    ],
    "type": "ServicePrincipal"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	null
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[][displayName=member]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Update service principal

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "Included Updated Properties",
        "newValue": "\"VALUE_2\"",
        "oldValue": null
      }
    ],
    "type": "ServicePrincipal"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[][displayName=Included Updated Properties]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Update application

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "EXAMPLE_LABEL_001",
        "newValue": "[]",
        "oldValue": "[\"VALUE_2\"]"
      },
      {
        "displayName": "Included Updated Properties",
        "newValue": "\"VALUE_3\"",
        "oldValue": null
      }
    ],
    "type": "Application"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	array
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].oldValue`	encoded-json
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[].oldValue`	string
`$[].modifiedProperties[].oldValue::<json>`	array
`$[].modifiedProperties[].oldValue::<json>[]`	string
`$[].modifiedProperties[][displayName=EXAMPLE_LABEL_001]`	named-property
`$[].modifiedProperties[][displayName=Included Updated Properties]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: GroupManagement · LoggedByService: Self-service Group Management · OperationName: GroupLifecyclePolicies_Get

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [],
    "type": "VALUE_2"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: UserManagement · LoggedByService: Core Directory · OperationName: Update user

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": null,
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "Included Updated Properties",
        "newValue": "\"VALUE_7\"",
        "oldValue": null
      },
      {
        "displayName": "SearchableDeviceKey",
        "newValue": "[\"VALUE_2\"]",
        "oldValue": "[\"VALUE_4\"]"
      },
      {
        "displayName": "TargetId.UserType",
        "newValue": "\"VALUE_8\"",
        "oldValue": null
      }
    ],
    "type": "User",
    "userPrincipalName": "USERNAME_1@example.invalid"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	null
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	array
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].newValue::<json>[]`	string
`$[].modifiedProperties[].oldValue`	encoded-json
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[].oldValue`	string
`$[].modifiedProperties[].oldValue::<json>`	array
`$[].modifiedProperties[].oldValue::<json>[]`	string
`$[].modifiedProperties[][displayName=Included Updated Properties]`	named-property
`$[].modifiedProperties[][displayName=SearchableDeviceKey]`	named-property
`$[].modifiedProperties[][displayName=TargetId.UserType]`	named-property
`$[].type`	string
`$[].userPrincipalName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Add delegated permission grant

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "EXAMPLE_LABEL_001",
        "newValue": "\"VALUE_4\"",
        "oldValue": "\"VALUE_4\""
      },
      {
        "displayName": "EXAMPLE_LABEL_002",
        "newValue": "\"00000000-0000-4000-8000-000000000002\"",
        "oldValue": "\"00000000-0000-4000-8000-000000000002\""
      },
      {
        "displayName": "EXAMPLE_LABEL_003",
        "newValue": "\"VALUE_2\"",
        "oldValue": "\"VALUE_3\""
      },
      {
        "displayName": "ServicePrincipal.AppId",
        "newValue": null,
        "oldValue": null
      },
      {
        "displayName": "ServicePrincipal.DisplayName",
        "newValue": null,
        "oldValue": null
      },
      {
        "displayName": "ServicePrincipal.Name",
        "newValue": null,
        "oldValue": null
      },
      {
        "displayName": "ServicePrincipal.ObjectID",
        "newValue": "\"00000000-0000-4000-8000-000000000003\"",
        "oldValue": null
      },
      {
        "displayName": "TargetId.ServicePrincipalNames",
        "newValue": "\"VALUE_5\"",
        "oldValue": null
      }
    ],
    "type": "ServicePrincipal"
  },
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": null,
    "id": "00000000-0000-4000-8000-000000000003",
    "modifiedProperties": [],
    "type": "ServicePrincipal"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	null
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	null
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].oldValue`	encoded-json
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[].oldValue`	string
`$[].modifiedProperties[].oldValue::<json>`	string
`$[].modifiedProperties[][displayName=EXAMPLE_LABEL_001]`	named-property
`$[].modifiedProperties[][displayName=EXAMPLE_LABEL_002]`	named-property
`$[].modifiedProperties[][displayName=EXAMPLE_LABEL_003]`	named-property
`$[].modifiedProperties[][displayName=ServicePrincipal.AppId]`	named-property
`$[].modifiedProperties[][displayName=ServicePrincipal.DisplayName]`	named-property
`$[].modifiedProperties[][displayName=ServicePrincipal.Name]`	named-property
`$[].modifiedProperties[][displayName=ServicePrincipal.ObjectID]`	named-property
`$[].modifiedProperties[][displayName=TargetId.ServicePrincipalNames]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Add app role assignment to service principal

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "00000000-0000-4000-8000-000000000004",
    "id": "00000000-0000-4000-8000-000000000003",
    "modifiedProperties": [],
    "type": "ServicePrincipal"
  },
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "AppRole.DisplayName",
        "newValue": "\"VALUE_3\"",
        "oldValue": null
      },
      {
        "displayName": "AppRole.Id",
        "newValue": "\"00000000-0000-4000-8000-000000000002\"",
        "oldValue": null
      },
      {
        "displayName": "AppRole.Value",
        "newValue": "\"VALUE_2\"",
        "oldValue": null
      },
      {
        "displayName": "AppRoleAssignment.CreatedDateTime",
        "newValue": "\"VALUE_4\"",
        "oldValue": null
      },
      {
        "displayName": "AppRoleAssignment.LastModifiedDateTime",
        "newValue": "\"VALUE_4\"",
        "oldValue": null
      },
      {
        "displayName": "ServicePrincipal.AppId",
        "newValue": "\"00000000-0000-4000-8000-000000000004\"",
        "oldValue": null
      },
      {
        "displayName": "ServicePrincipal.DisplayName",
        "newValue": "\"VALUE_5\"",
        "oldValue": null
      },
      {
        "displayName": "ServicePrincipal.Name",
        "newValue": "\"00000000-0000-4000-8000-000000000004\"",
        "oldValue": null
      },
      {
        "displayName": "ServicePrincipal.ObjectID",
        "newValue": "\"00000000-0000-4000-8000-000000000003\"",
        "oldValue": null
      },
      {
        "displayName": "TargetId.ServicePrincipalNames",
        "newValue": "\"VALUE_6\"",
        "oldValue": null
      }
    ],
    "type": "ServicePrincipal"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[][displayName=AppRole.DisplayName]`	named-property
`$[].modifiedProperties[][displayName=AppRole.Id]`	named-property
`$[].modifiedProperties[][displayName=AppRole.Value]`	named-property
`$[].modifiedProperties[][displayName=AppRoleAssignment.CreatedDateTime]`	named-property
`$[].modifiedProperties[][displayName=AppRoleAssignment.LastModifiedDateTime]`	named-property
`$[].modifiedProperties[][displayName=ServicePrincipal.AppId]`	named-property
`$[].modifiedProperties[][displayName=ServicePrincipal.DisplayName]`	named-property
`$[].modifiedProperties[][displayName=ServicePrincipal.Name]`	named-property
`$[].modifiedProperties[][displayName=ServicePrincipal.ObjectID]`	named-property
`$[].modifiedProperties[][displayName=TargetId.ServicePrincipalNames]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Add application

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "AppId",
        "newValue": "[\"00000000-0000-4000-8000-000000000002\"]",
        "oldValue": "[]"
      },
      {
        "displayName": "DisplayName",
        "newValue": "[\"VALUE_2\"]",
        "oldValue": "[]"
      },
      {
        "displayName": "EXAMPLE_LABEL_001",
        "newValue": "[false]",
        "oldValue": "[]"
      },
      {
        "displayName": "EXAMPLE_LABEL_002",
        "newValue": "[\"VALUE_3\"]",
        "oldValue": "[]"
      },
      {
        "displayName": "EXAMPLE_LABEL_003",
        "newValue": "[{\"AllProperties\":false,\"CredentialsWithUsageSign\":false,\"CredentialsWithUsageVerify\":false,\"IdentifierUris\":false,\"IsEnabled\":false,\"ServicePrincipalLockExtension\":\"VALUE_4\",\"TokenEncryptionKeyId\":false}]",
        "oldValue": "[]"
      },
      {
        "displayName": "EXAMPLE_LABEL_004",
        "newValue": "[\"VALUE_5\"]",
        "oldValue": "[]"
      },
      {
        "displayName": "Included Updated Properties",
        "newValue": "\"VALUE_6\"",
        "oldValue": null
      },
      {
        "displayName": "RequiredResourceAccess",
        "newValue": "[{\"EncodingVersion\":1,\"RequiredAppPermissions\":[{\"DirectAccessGrant\":false,\"EntitlementId\":\"00000000-0000-4000-8000-000000000003\",\"ImpersonationAccessGrants\":[1]}],\"ResourceAppId\":\"00000000-0000-4000-8000-000000000004\"}]",
        "oldValue": "[]"
      }
    ],
    "type": "Application"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	array
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].newValue::<json>[]`	boolean
`$[].modifiedProperties[].newValue::<json>[]`	object
`$[].modifiedProperties[].newValue::<json>[]`	string
`$[].modifiedProperties[].newValue::<json>[].AllProperties`	boolean
`$[].modifiedProperties[].newValue::<json>[].CredentialsWithUsageSign`	boolean
`$[].modifiedProperties[].newValue::<json>[].CredentialsWithUsageVerify`	boolean
`$[].modifiedProperties[].newValue::<json>[].EncodingVersion`	integer
`$[].modifiedProperties[].newValue::<json>[].IdentifierUris`	boolean
`$[].modifiedProperties[].newValue::<json>[].IsEnabled`	boolean
`$[].modifiedProperties[].newValue::<json>[].RequiredAppPermissions`	array
`$[].modifiedProperties[].newValue::<json>[].RequiredAppPermissions[]`	object
`$[].modifiedProperties[].newValue::<json>[].RequiredAppPermissions[].DirectAccessGrant`	boolean
`$[].modifiedProperties[].newValue::<json>[].RequiredAppPermissions[].EntitlementId`	string
`$[].modifiedProperties[].newValue::<json>[].RequiredAppPermissions[].ImpersonationAccessGrants`	array
`$[].modifiedProperties[].newValue::<json>[].RequiredAppPermissions[].ImpersonationAccessGrants[]`	integer
`$[].modifiedProperties[].newValue::<json>[].ResourceAppId`	string
`$[].modifiedProperties[].newValue::<json>[].ServicePrincipalLockExtension`	string
`$[].modifiedProperties[].newValue::<json>[].TokenEncryptionKeyId`	boolean
`$[].modifiedProperties[].oldValue`	encoded-json
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[].oldValue`	string
`$[].modifiedProperties[].oldValue::<json>`	array
`$[].modifiedProperties[][displayName=AppId]`	named-property
`$[].modifiedProperties[][displayName=DisplayName]`	named-property
`$[].modifiedProperties[][displayName=EXAMPLE_LABEL_001]`	named-property
`$[].modifiedProperties[][displayName=EXAMPLE_LABEL_002]`	named-property
`$[].modifiedProperties[][displayName=EXAMPLE_LABEL_003]`	named-property
`$[].modifiedProperties[][displayName=EXAMPLE_LABEL_004]`	named-property
`$[].modifiedProperties[][displayName=Included Updated Properties]`	named-property
`$[].modifiedProperties[][displayName=RequiredResourceAccess]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: Authentication · LoggedByService: B2C · OperationName: Validate user authentication

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "00000000-0000-4000-8000-000000000001",
    "id": null,
    "modifiedProperties": [],
    "type": "VALUE_2"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	null
`$[].modifiedProperties`	array
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Category: ApplicationManagement · LoggedByService: Core Directory · OperationName: Update application

All values in this example are synthetic. Format: JSON; column encoding: json-string.

[
  {
    "administrativeUnits": [],
    "agentType": "VALUE_1",
    "displayName": "USERNAME_1",
    "id": "00000000-0000-4000-8000-000000000001",
    "modifiedProperties": [
      {
        "displayName": "EXAMPLE_LABEL_001",
        "newValue": "[{\"Key\":\"VALUE_2\",\"Value\":\"https://example.invalid/SAMPLE_1\"}]",
        "oldValue": "[]"
      },
      {
        "displayName": "Included Updated Properties",
        "newValue": "\"VALUE_3\"",
        "oldValue": null
      }
    ],
    "type": "Application"
  }
]

Payload fields and types

Path	Type
`$`	array
`$[]`	object
`$[].administrativeUnits`	array
`$[].agentType`	string
`$[].displayName`	string
`$[].id`	string
`$[].modifiedProperties`	array
`$[].modifiedProperties[]`	object
`$[].modifiedProperties[].displayName`	string
`$[].modifiedProperties[].newValue`	encoded-json
`$[].modifiedProperties[].newValue`	string
`$[].modifiedProperties[].newValue::<json>`	array
`$[].modifiedProperties[].newValue::<json>`	string
`$[].modifiedProperties[].newValue::<json>[]`	object
`$[].modifiedProperties[].newValue::<json>[].Key`	string
`$[].modifiedProperties[].newValue::<json>[].Value`	string
`$[].modifiedProperties[].oldValue`	encoded-json
`$[].modifiedProperties[].oldValue`	null
`$[].modifiedProperties[].oldValue`	string
`$[].modifiedProperties[].oldValue::<json>`	array
`$[].modifiedProperties[][displayName=EXAMPLE_LABEL_001]`	named-property
`$[].modifiedProperties[][displayName=Included Updated Properties]`	named-property
`$[].type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

AuditLogs Schema

Table description

TableSection	TableType	TableSectionName	Description	Source
Usx		LogManagement	Audit log for Azure Active Directory. Includes system activity information about user and group management managed applications and directory activities.	Sentinel

Schema

Name	Description	Type
_BilledSize		Double
_IsBillable		String
AADOperationType	Type of the operation. Possible values are Add Update Delete and Other.	String
AADTenantId	ID of the ADD tenant	String
ActivityDateTime	Date and time the activity was performed in UTC.	DateTime
ActivityDisplayName	Activity name or the operation name. Examples include Create User and Add member to group. For full list see Azure AD activity list.	String
AdditionalDetails	Indicates additional details on the activity.	Object
Category	Type of threat indicator or breach activity identified by the alert	String
CorrelationId	Unique identifier of the sign-in event	String
DurationMs	Property is not used and can be ignored.	Int64
Id	Unique id of the activity log	String
Identity	Identity from the token that was presented when the request was made. The identity can be a user account system account or service principal.	String
InitiatedBy	User or app initiated the activity.	Object
Level	Message type. This is currently always Informational.	String
Location	City, country, or other geographic location associated with the event	String
LoggedByService	Service that initiated the activity (For example: Self-service Password Management Core Directory B2C Invited Users Microsoft Identity Manager Privileged Identity Management.	String
OperationName	Audit event operation name as appeared in the raw event schema. Usually includes both resource type and operation	String
OperationVersion	REST API version that’s requested by the client.	String
Resource		String
ResourceGroup		String
ResourceId	Unique identifier of the resource accessed	String
ResourceProvider		String
Result	Result of the activity. Possible values are: success failure timeout unknownFutureValue.	String
ResultDescription	Additional description of the operation’s result	String
ResultReason	Describes cause of failure or timeout results.	String
ResultSignature	Property is not used and can be ignored.	String
ResultType	Result of the operation. Possible values: Success, Failure	String
SourceSystem		String
TargetResources	Indicates information on which resource was changed due to the activity. Target Resource Type can be User, Device, Directory, App, Role, Group, Policy or Other	Object
TimeGenerated	Date and time the record was created.	DateTime
Type	The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other	String

Schema changes

Date	Action
2026-10-07	Table added to tracking
2026-01-02	Table removed from tracking
2024-10-18	Table added to tracking

Known observations

Value casing varies

Fields: ResultDescription, ResultReason.

Values in this field have been observed with different casing. Choose comparison behavior according to the meaning of the value and the query intent.

Sources: Olaf Hartong.

AuditLogs Schema

Table description

TableSection	TableType	TableSectionName	Description	Source
Usx		LogManagement	Audit log for Azure Active Directory. Includes system activity information about user and group management managed applications and directory activities.	Sentinel

Schema

Name	Description	Type
_BilledSize		Double
_IsBillable		String
AADOperationType	Type of the operation. Possible values are Add Update Delete and Other.	String
AADTenantId	ID of the ADD tenant	String
ActivityDateTime	Date and time the activity was performed in UTC.	DateTime
ActivityDisplayName	Activity name or the operation name. Examples include Create User and Add member to group. For full list see Azure AD activity list.	String
AdditionalDetails	Indicates additional details on the activity.	Object
Category	Type of threat indicator or breach activity identified by the alert	String
CorrelationId	Unique identifier of the sign-in event	String
DurationMs	Property is not used and can be ignored.	Int64
Id	Unique id of the activity log	String
Identity	Identity from the token that was presented when the request was made. The identity can be a user account system account or service principal.	String
InitiatedBy	User or app initiated the activity.	Object
Level	Message type. This is currently always Informational.	String
Location	City, country, or other geographic location associated with the event	String
LoggedByService	Service that initiated the activity (For example: Self-service Password Management Core Directory B2C Invited Users Microsoft Identity Manager Privileged Identity Management.	String
OperationName	Audit event operation name as appeared in the raw event schema. Usually includes both resource type and operation	String
OperationVersion	REST API version that’s requested by the client.	String
Resource		String
ResourceGroup		String
ResourceId	Unique identifier of the resource accessed	String
ResourceProvider		String
Result	Result of the activity. Possible values are: success failure timeout unknownFutureValue.	String
ResultDescription	Additional description of the operation’s result	String
ResultReason	Describes cause of failure or timeout results.	String
ResultSignature	Property is not used and can be ignored.	String
ResultType	Result of the operation. Possible values: Success, Failure	String
SourceSystem		String
TargetResources	Indicates information on which resource was changed due to the activity. Target Resource Type can be User, Device, Directory, App, Role, Group, Policy or Other	Object
TimeGenerated	Date and time the record was created.	DateTime
Type	The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other	String

Schema changes

Date	Action
2026-10-07	Table added to tracking
2026-01-02	Table removed from tracking
2024-10-18	Table added to tracking

Known observations

Value casing varies

Fields: ResultDescription, ResultReason.

Values in this field have been observed with different casing. Choose comparison behavior according to the meaning of the value and the query intent.

Sources: Olaf Hartong.