directory_audits

Creates, updates, deletes, gets or lists a directory_audits resource.

Overview

Name	directory_audits
Type	Resource
Id	entra_id.audit_logs.directory_audits

Fields

The following fields are returned by SELECT queries:

get

Retrieved navigation property

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
activityDateTime	string (date-time)	Indicates the date and time the activity was performed. The Timestamp type is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Supports $filter (eq, ge, le) and $orderby. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
activityDisplayName	string	Indicates the activity name or the operation name (examples: 'Create User' and 'Add member to group'). For a list of activities logged, refer to Microsoft Entra audit log categories and activities. Supports $filter (eq, startswith).
additionalDetails	array	Indicates additional details on the activity.
category	string	Indicates which resource category that's targeted by the activity. For example: UserManagement, GroupManagement, ApplicationManagement, RoleManagement. For a list of categories for activities logged, refer to Microsoft Entra audit log categories and activities.
correlationId	string	Indicates a unique ID that helps correlate activities that span across various services. Can be used to trace logs across services. Supports $filter (eq).
initiatedBy	object	(title: auditActivityInitiator)
loggedByService	string	Indicates information on which service initiated the activity (For example: Self-service Password Management, Core Directory, B2C, Invited Users, Microsoft Identity Manager, Privileged Identity Management. Supports $filter (eq).
operationType	string	Indicates the type of operation that was performed. The possible values include but are not limited to the following: Add, Assign, Update, Unassign, and Delete.
result		Indicates the result of the activity. The possible values are: success, failure, timeout, unknownFutureValue.
resultReason	string	Indicates the reason for failure if the result is failure or timeout.
targetResources	array	Indicates information on which resource was changed due to the activity. Target Resource Type can be User, Device, Directory, App, Role, Group, Policy or Other. Supports $filter (eq) for id and displayName; and $filter (startswith) for displayName.

list

Retrieved collection

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
activityDateTime	string (date-time)	Indicates the date and time the activity was performed. The Timestamp type is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Supports $filter (eq, ge, le) and $orderby. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
activityDisplayName	string	Indicates the activity name or the operation name (examples: 'Create User' and 'Add member to group'). For a list of activities logged, refer to Microsoft Entra audit log categories and activities. Supports $filter (eq, startswith).
additionalDetails	array	Indicates additional details on the activity.
category	string	Indicates which resource category that's targeted by the activity. For example: UserManagement, GroupManagement, ApplicationManagement, RoleManagement. For a list of categories for activities logged, refer to Microsoft Entra audit log categories and activities.
correlationId	string	Indicates a unique ID that helps correlate activities that span across various services. Can be used to trace logs across services. Supports $filter (eq).
initiatedBy	object	(title: auditActivityInitiator)
loggedByService	string	Indicates information on which service initiated the activity (For example: Self-service Password Management, Core Directory, B2C, Invited Users, Microsoft Identity Manager, Privileged Identity Management. Supports $filter (eq).
operationType	string	Indicates the type of operation that was performed. The possible values include but are not limited to the following: Add, Assign, Update, Unassign, and Delete.
result		Indicates the result of the activity. The possible values are: success, failure, timeout, unknownFutureValue.
resultReason	string	Indicates the reason for failure if the result is failure or timeout.
targetResources	array	Indicates information on which resource was changed due to the activity. Target Resource Type can be User, Device, Directory, App, Role, Group, Policy or Other. Supports $filter (eq) for id and displayName; and $filter (startswith) for displayName.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	directory_audit_id		Get a specific Microsoft Entra audit log item. This includes an audit log item generated by various services within Microsoft Entra ID like user, application, device and group management, privileged identity management (PIM), access reviews, terms of use, identity protection, password management (self-service and admin password resets), self-service group management, and so on.
list	select			Get the list of audit logs generated by Microsoft Entra ID. This includes audit logs generated by various services within Microsoft Entra ID, including user, app, device and group Management, privileged identity management (PIM), access reviews, terms of use, identity protection, password management (self-service and admin password resets), and self- service group management, and so on.
insert	insert
update	update	directory_audit_id
delete	delete	directory_audit_id	If-Match

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
directory_audit_id	string	The unique identifier of directoryAudit
If-Match	string	ETag

SELECT examples

get

Get a specific Microsoft Entra audit log item. This includes an audit log item generated by various services within Microsoft Entra ID like user, application, device and group management, privileged identity management (PIM), access reviews, terms of use, identity protection, password management (self-service and admin password resets), self-service group management, and so on.

SELECT
id,
activityDateTime,
activityDisplayName,
additionalDetails,
category,
correlationId,
initiatedBy,
loggedByService,
operationType,
result,
resultReason,
targetResources
FROM entra_id.audit_logs.directory_audits
WHERE directory_audit_id = '{{ directory_audit_id }}' -- required
;

list

Get the list of audit logs generated by Microsoft Entra ID. This includes audit logs generated by various services within Microsoft Entra ID, including user, app, device and group Management, privileged identity management (PIM), access reviews, terms of use, identity protection, password management (self-service and admin password resets), and self- service group management, and so on.

SELECT
id,
activityDateTime,
activityDisplayName,
additionalDetails,
category,
correlationId,
initiatedBy,
loggedByService,
operationType,
result,
resultReason,
targetResources
FROM entra_id.audit_logs.directory_audits
;

INSERT examples

insert

No description available.

INSERT INTO entra_id.audit_logs.directory_audits (
id,
activityDateTime,
activityDisplayName,
additionalDetails,
category,
correlationId,
initiatedBy,
loggedByService,
operationType,
result,
resultReason,
targetResources
)
SELECT 
'{{ id }}',
'{{ activityDateTime }}',
'{{ activityDisplayName }}',
'{{ additionalDetails }}',
'{{ category }}',
'{{ correlationId }}',
'{{ initiatedBy }}',
'{{ loggedByService }}',
'{{ operationType }}',
'{{ result }}',
'{{ resultReason }}',
'{{ targetResources }}'
RETURNING
id,
activityDateTime,
activityDisplayName,
additionalDetails,
category,
correlationId,
initiatedBy,
loggedByService,
operationType,
result,
resultReason,
targetResources
;

Manifest

# Description fields are for documentation purposes
- name: directory_audits
props:
  - name: id
    value: "{{ id }}"
    description: |
      The unique identifier for an entity. Read-only.
  - name: activityDateTime
    value: "{{ activityDateTime }}"
    description: |
      Indicates the date and time the activity was performed. The Timestamp type is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Supports $filter (eq, ge, le) and $orderby.
  - name: activityDisplayName
    value: "{{ activityDisplayName }}"
    description: |
      Indicates the activity name or the operation name (examples: 'Create User' and 'Add member to group'). For a list of activities logged, refer to Microsoft Entra audit log categories and activities. Supports $filter (eq, startswith).
  - name: additionalDetails
    description: |
      Indicates additional details on the activity.
    value:
      - key: "{{ key }}"
        value: "{{ value }}"
  - name: category
    value: "{{ category }}"
    description: |
      Indicates which resource category that's targeted by the activity. For example: UserManagement, GroupManagement, ApplicationManagement, RoleManagement. For a list of categories for activities logged, refer to Microsoft Entra audit log categories and activities.
  - name: correlationId
    value: "{{ correlationId }}"
    description: |
      Indicates a unique ID that helps correlate activities that span across various services. Can be used to trace logs across services. Supports $filter (eq).
  - name: initiatedBy
    value:
      app:
        appId: "{{ appId }}"
        displayName: "{{ displayName }}"
        servicePrincipalId: "{{ servicePrincipalId }}"
        servicePrincipalName: "{{ servicePrincipalName }}"
      user:
        displayName: "{{ displayName }}"
        id: "{{ id }}"
        ipAddress: "{{ ipAddress }}"
        userPrincipalName: "{{ userPrincipalName }}"
  - name: loggedByService
    value: "{{ loggedByService }}"
    description: |
      Indicates information on which service initiated the activity (For example: Self-service Password Management, Core Directory, B2C, Invited Users, Microsoft Identity Manager, Privileged Identity Management. Supports $filter (eq).
  - name: operationType
    value: "{{ operationType }}"
    description: |
      Indicates the type of operation that was performed. The possible values include but are not limited to the following: Add, Assign, Update, Unassign, and Delete.
  - name: result
    value: "{{ result }}"
    description: |
      Indicates the result of the activity. The possible values are: success, failure, timeout, unknownFutureValue.
  - name: resultReason
    value: "{{ resultReason }}"
    description: |
      Indicates the reason for failure if the result is failure or timeout.
  - name: targetResources
    description: |
      Indicates information on which resource was changed due to the activity. Target Resource Type can be User, Device, Directory, App, Role, Group, Policy or Other. Supports $filter (eq) for id and displayName; and $filter (startswith) for displayName.
    value:
      - displayName: "{{ displayName }}"
        groupType: "{{ groupType }}"
        id: "{{ id }}"
        modifiedProperties: "{{ modifiedProperties }}"
        type: "{{ type }}"
        userPrincipalName: "{{ userPrincipalName }}"

UPDATE examples

update

No description available.

UPDATE entra_id.audit_logs.directory_audits
SET 
id = '{{ id }}',
activityDateTime = '{{ activityDateTime }}',
activityDisplayName = '{{ activityDisplayName }}',
additionalDetails = '{{ additionalDetails }}',
category = '{{ category }}',
correlationId = '{{ correlationId }}',
initiatedBy = '{{ initiatedBy }}',
loggedByService = '{{ loggedByService }}',
operationType = '{{ operationType }}',
result = '{{ result }}',
resultReason = '{{ resultReason }}',
targetResources = '{{ targetResources }}'
WHERE 
directory_audit_id = '{{ directory_audit_id }}' --required
RETURNING
id,
activityDateTime,
activityDisplayName,
additionalDetails,
category,
correlationId,
initiatedBy,
loggedByService,
operationType,
result,
resultReason,
targetResources;

DELETE examples

delete

No description available.

DELETE FROM entra_id.audit_logs.directory_audits
WHERE directory_audit_id = '{{ directory_audit_id }}' --required
AND If-Match = '{{ If-Match }}'
;