Dynamics365Activity

Dynamics365Activity Schema #

Table description #

TableSection TableType TableSectionName Description
Usx Regular Microsoft Sentinel Audit logs for Dynamics 365 tenants collected by Azure Sentinel.

Table retention #

HotDays ColdDays TotalInteractiveDays
14 76 90

Schema #

Name Description Type
_BilledSize Double
_IsBillable String
_ResourceId A unique identifier for the resource that the record is associated with String
_SubscriptionId A unique identifier for the subscription that the record is associated with String
ClientIP The IP address of the device that was used when the activity was logged String
CorrelationId A unique value used to associate related rows String
CrmOrganizationUniqueName Unique name of the organization String
EntityId Unique identifier of the entity String
EntityName Name of the entity in the organization String
Fields JSON of Key Value pair reflecting the values that were created or updated Object
InstanceUrl URL to the instance String
ItemType The type of object that was accessed or modified. See the ItemType table for details on the types of objects String
ItemUrl URL to the record emitting the log String
Message Name of the message called in the Dynamics365 SDK String
OfficeWorkload The Office 365 service where the activity occurred String
Operation The name of the operation that the user is performing String
OrganizationId The GUID for your organization’s Office 365 tenant. This value will always be the same for your organization String
OriginalObjectId The ObjectId for SharePoint and OneDrive about business activity String
Query The query filter parameters used while executing the FetchXML String
QueryResults One or multiple unique records returned by the Retrieve and Retrieve Multiple SDK message call Object
RecordType The type of operation indicated by the record. See the AuditLogRecordType table in Office 365 management activity api schema documentation for details on the types of audit log records String
ResultStatus Indicates whether the action (specified in the Operation property) was successful or not String
ServiceName Name of the Service generating the log String
SourceRecordId Unique identifier of an audit record String
SourceSystem String
SystemUserId Unique identifier of the user GUID in the organization String
TenantId String
TimeGenerated The date and time in Coordinated Universal Time (UTC) when the user performed the activity DateTime
Type The name of the table String
UserAgent The user agent String
UserId The UPN (User Principal Name) of the user who performed the action (specified in the Operation property) that resulted in the record being logged String
UserKey An alternative ID for the user identified in the UserId property String
UserType The type of user that performed the operation. See the UserType table in Office 365 management activity api schema documentation for details on the types of users String

Schema changes #

Date Action
2024-10-18 Table added to tracking