DataverseActivity

DataverseActivity Schema #

Table description #

TableSection TableType TableSectionName Description
Usx Regular Microsoft Sentinel Contains Microsoft Dataverse audit logs. It’s typically used to track Dataverse and Dynamics 365 activities.

Table retention #

HotDays ColdDays TotalInteractiveDays
14 76 90

Schema #

Name Description Type
_BilledSize Double
_IsBillable String
ClientIp The IP address of the device that was used when the activity was logged. String
CorrelationId A unique value used to associate related rows. String
CrmOrganizationUniqueName Unique name of the organization. String
EntityId Unique identifier of the entity. String
EntityName Name of the entity in the organization. String
Fields JSON of Key Value pair reflecting the values that were created or updated. Object
InstanceUrl URL to the instance. String
ItemType The type of object that was accessed or modified. See the ItemType table for details on the types of objects. String
ItemUrl URL to the record emitting the log. String
Message Name of the message called in the Dynamics 365 SDK. String
Operation The name of the operation that the user is performing. String
OrganizationId The GUID for your organization’s Office 365 tenant. This value will always be the same for your organization. String
OriginalObjectId The ObjectId for Dataverse operation or business activity. String
Query The query filter parameters used while executing the FetchXML. String
QueryResults One or multiple unique records returned by the Retrieve and Retrieve Multiple SDK message call. Object
ResultStatus Indicates whether the action (specified in the Operation property) was successful or not. String
ServiceContextId The unique id associated with service context. String
ServiceContextIdType Application defined token to define context use. String
ServiceName Name of the Service generating the log. String
SourceRecordId Unique identifier of an audit record. String
SourceSystem String
SystemUserId Unique identifier of the user GUID in the organization. String
TenantId String
TimeGenerated The date and time in (UTC) when the user performed the activity. DateTime
Type The name of the table String
UserAgent The user agent. String
UserId The Dataverse user ID of the user who performed the action (specified in the Operation property) that resulted in the record being logged. String
UserKey An alternative ID for the user identified in the UserId property. String
UserType The type of user that performed the operation. See the UserType table in Office 365 management activity api schema documentation for details on the types of users. String
UserUpn The UPN (User Principal Name) of the user who performed the action (specified in the Operation property) that resulted in the record being logged. String

Schema changes #

Date Action
2024-10-18 Table added to tracking