MicrosoftGraphActivityLogs

MicrosoftGraphActivityLogs Schema #

Table description #

TableSection TableType TableSectionName Description
Usx Regular LogManagement Microsoft Graph Activity Logs provide details of API requests made to Microsoft Graph for resources in the tenant.

Table retention #

HotDays ColdDays TotalInteractiveDays
14 76 90

Schema #

Name Description Type
_BilledSize Double
_IsBillable String
AadTenantId The Azure AD tenant ID. String
ApiVersion The API version of the event. String
AppId The identifier for the application. String
ATContent Reserved for future use. String
ATContentH Reserved for future use. String
ATContentP Reserved for future use. String
ClientAuthMethod Indicates how the client was authenticated. For a public client, the value is 0. If client ID and client secret are used, the value is 1. If a client certificate was used for authentication, the value is 2. Int32
ClientRequestId Optional. The client request identifier when sent. If no client request identifier is sent, the value will be equal to the operation identifier. String
DurationMs The duration of the request in milliseconds. Int32
IdentityProvider The identity provider that authenticated the subject of the token. String
IPAddress The IP address of the client from where the request occurred. String
Location The name of the region that served the request. String
OperationId The identifier for the batch. For non-batched requests, this will be unique per request. For batched requests, this will be the same for all requests in the batch. String
RequestId The identifier representing the request. String
RequestMethod The HTTP method of the event. String
RequestUri The URI of the request. String
ResponseSizeBytes The size of the response in Bytes. Int32
ResponseStatusCode The HTTP response status code for the event. Int32
Roles The roles in token claims. String
Scopes The scopes in token claims. String
ServicePrincipalId The identifier of the servicePrincipal making the request. String
SignInActivityId The identifier representing the sign-in activitys. String
SourceSystem String
TenantId String
TimeGenerated The date and time the request was received. DateTime
TokenIssuedAt The timestamp the token was issued at. DateTime
Type The name of the table String
UserAgent The user agent information related to request. String
UserId The identifier of the user making the request. String
Wids Denotes the tenant-wide roles assigned to this user. String

Schema changes #

Date Action
2024-10-18 Table added to tracking