Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Namespace: microsoft.graph.security
The following resource types inherit from the auditData abstract type. Each derived type represents audit log data for a specific Microsoft 365 service or feature, returned as the auditData property of an auditLogRecord.
- a365AiExecuteTool
- a365AiGuardrail
- a365AiInferenceCall
- a365AiInvokeAgent
- a365AiRunSummary
- a365SpanOutputs
- aadRiskDetectionAuditRecord
- aedAuditRecord
- agentAdminActivityRecord
- agentSettingAdminActivity
- aiAppInteractionAuditRecord
- aiExecuteToolAuditRecord
- aiGuardrail
- aiInteractionsChangeNotificationAuditRecord
- aiInteractionsExportAuditRecord
- aiInteractionsSubscriptionAuditRecord
- aiInvokeAgentAuditRecord
- aISpanOutputsAuditRecord
- aipDiscover
- aipFileDeleted
- aipHeartBeat
- aipProtectionActionLogRequest
- aipScannerDiscoverEvent
- aipSensitivityLabelActionLogRequest
- airAdminActionInvestigationData
- airInvestigationData
- airManualInvestigationData
- alertSubmissionAuditRecord
- alertSubmissionResultDetailAuditRecord
- attackSimAdminAuditRecord
- attackSimAuditRecord
- auditConfigAuditRecord
- auditSearchAuditRecord
- azfwApplicationRuleAggregationEventRecord
- azfwDnsQueryEventRecord
- azfwNetworkRuleEventRecord
- azureActiveDirectoryAccountLogonAuditRecord
- azureActiveDirectoryAuditRecord
- azureActiveDirectoryStsLogonAuditRecord
- azureAISearchAuditRecord
- campaignAuditRecord
- ccraiPolicyViolationRecord
- cdpClassifierHealthRecord
- cdpColdCrawlStatusRecord
- cdpConsumptionResourceRecord
- cdpContentExplorerAggregateRecord
- cdpdlmaiInteractionInsightsRecord
- cdpDlpSensitiveEndpointAuditRecord
- cdpLogRecord
- cdpOcrBillingRecord
- cdpResourceScopeChangeEventRecord
- cloudSecurityConnector
- cloudSecurityEnablement
- cloudSecurityManagement
- cloudUpdateDeviceConfigAuditRecord
- cloudUpdateProfileConfigAuditRecord
- cloudUpdateTenantConfigAuditRecord
- complianceConnectorAuditRecord
- complianceDLMExchangeAuditRecord
- complianceDLMSharePointAuditRecord
- complianceDlpApplicationsAuditRecord
- complianceDlpApplicationsClassificationAuditRecord
- complianceDlpEndpointAuditRecord
- complianceDlpEndpointDiscoveryAuditRecord
- complianceDLPEnforcementAuditRecord
- complianceDlpExchangeAuditRecord
- complianceDlpExchangeClassificationAuditRecord
- complianceDlpExchangeClassificationCdpRecord
- complianceDlpExchangeDiscoveryAuditRecord
- complianceDlpSharePointAuditRecord
- complianceDlpSharePointClassificationAuditRecord
- complianceDLPSharePointClassificationCdpRecord
- complianceDlpSharePointClassificationExtendedAuditRecord
- complianceEndpointEvaluationIncomplete
- complianceEvaluationIncomplete
- complianceExchangeOcrAuditRecord
- complianceManagerActionRecord
- compliancePolicyGradingSharePointAuditRecord
- complianceSettingsChangeAuditRecord
- complianceSitGradingSharePointAuditRecord
- complianceSupervisionExchangeAuditRecord
- connectedAIAppInteractionAuditRecord
- consumptionResourceAuditRecord
- contentStoreMetadataRecord
- copilotAgentManagementAuditRecord
- copilotForSecurityLoggingAuditRecord
- copilotForSecurityTriggerAuditRecord
- copilotInteractionAuditRecord
- copilotPluginSettingAuditRecord
- copilotPromptBookSettingAuditRecord
- copilotSessionSharingAuditRecord
- copilotSettingAuditRecord
- copilotWorkspaceSettingAuditRecord
- coreReportingSettingsAuditRecord
- cortanaBriefingAuditRecord
- criticalAssetManagementClassificationRecord
- crmEntityOperationAuditRecord
- crossTenantAccessPolicyAuditRecord
- cscContentMetadata
- customerKeyServiceEncryptionAuditRecord
- dataCenterSecurityCmdletAuditRecord
- dataGovernanceAuditRecord
- dataInsightsRestApiAuditRecord
- dataLakeExportOperationAuditRecord
- dataSecurityInvestigationAuditRecord
- dataShareOperationAuditRecord
- defaultAuditData
- defenderAutomationRule
- defenderCaseManagementAuditRecord
- defenderGeneratedPlaybook
- defenderIntegration
- defenderPreviewFeaturesRecord
- defenderSecurityForAIConfigurationAuditRecord
- deployFeatureActivityRecord
- deviceDiscoverySettingsAuthenticatedScansRecord
- deviceDiscoverySettingsExclusionRecord
- deviceDiscoverySettingsRecord
- discoveryAuditRecord
- dlpEndpointAuditRecord
- dlpImportResultAuditRecord
- dlpSensitiveInformationTypeRulePackageCmdletRecord
- dragonCopilotAccessRecord
- dragonCopilotAdminRecord
- dragonCopilotClinicalDataRecord
- dragonCopilotSessionRecord
- dspmAdminActivity
- dynamics365BusinessCentralAuditRecord
- ecsContentMetadata
- ehrConnectorAuditBaseRecord
- eopSubmissionFeedEntityAuditRecord
- exchangeAdminAuditRecord
- exchangeAggregatedMailboxAuditRecord
- exchangeAggregatedOperationRecord
- exchangeMailboxAuditGroupRecord
- exchangeMailboxAuditRecord
- fabricAuditRecord
- fabricPolicyRecord
- filteringTeamsMessageFileInfo
- healthcareSignalRecord
- hostedRpaAuditRecord
- hrSignalAuditRecord
- hygieneEventRecord
- informationBarrierPolicyApplicationAuditRecord
- informationWorkerProtectionAuditRecord
- insiderRiskScopedUserInsightsRecord
- insiderRiskScopedUsersRecord
- integratedAppsAppAdminActivityAuditRecord
- integratedAppsAppSettingsAdminActivityAuditRecord
- irmActivityAuditTrailRecord
- irmUserDefinedDetectionRecord
- kaizalaAuditRecord
- labelAnalyticsAggregateAuditRecord
- labelContentExplorerAuditRecord
- largeContentMetadataAuditRecord
- m365ComplianceConnectorAuditRecord
- m365DAADAuditRecord
- m365odspAssetMetadataRecord
- m365SearchSectionsRecord
- mailSubmissionData
- managedServicesAuditRecord
- managedTenantsAuditRecord
- mapgAlertsAuditRecord
- mapgOnboardAuditRecord
- mapgPolicyAuditRecord
- mapgRemediationAuditRecord
- mcasAlertsAuditRecord
- mcsRawEmailContentMetadata
- mdaAuditRecord
- mdaDataSecuritySignalRecord
- mDASHAuditRecord
- mdatpAuditRecord
- mdcEventsRecord
- mdiAuditRecord
- meshWorldsAuditRecord
- mesRawEmailContentMetadata
- microsoft365BackupBackupItemAuditRecord
- microsoft365BackupBackupPolicyAuditRecord
- microsoft365BackupGranularBrowseTaskAuditRecord
- microsoft365BackupRestoreItemAuditRecord
- microsoft365BackupRestoreTaskAuditRecord
- microsoft365CopilotScheduledPromptAuditRecord
- microsoftDefenderExpertsXDRAuditRecord
- microsoftFlowAuditRecord
- microsoftFormsAuditRecord
- microsoftGraphDataConnectConsent
- microsoftGraphDataConnectOperation
- microsoftPurviewDataCatalogOperationRecord
- microsoftPurviewDataMapOperationRecord
- microsoftPurviewMetadataPolicyOperationRecord
- microsoftPurviewPolicyOperationRecord
- microsoftPurviewPrivacyAuditEvent
- microsoftPurviewUnifiedCatalogOperationRecord
- microsoftSecurityForAiConfiguration
- microsoftSecurityForAiRealTimeProtection
- microsoftStreamAuditRecord
- microsoftTeamsAdminAuditRecord
- microsoftTeamsAnalyticsAuditRecord
- microsoftTeamsAuditRecord
- microsoftTeamsDeviceAuditRecord
- microsoftTeamsMoveMessages
- microsoftTeamsRetentionLabelActionAuditRecord
- microsoftTeamsSensitivityLabelActionAuditRecord
- microsoftTeamsShiftsAuditRecord
- microsoftTeamsUserConcernAuditRecord
- mipAutoLabelExchangeItemAuditRecord
- mipAutoLabelProgressFeedbackAuditRecord
- mipAutoLabelSharePointItemAuditRecord
- mipAutoLabelSharePointPolicyLocationAuditRecord
- mipAutoLabelSimulationSharePointCompletionRecord
- mipAutoLabelSimulationSharePointProgressRecord
- mipAutoLabelSimulationStatisticsRecord
- mipExactDataMatchAuditRecord
- mipLabelAnalyticsAuditRecord
- mipLabelAuditRecord
- mosAgentInfoRecord
- mosAgentInfoRecordV2
- mS365DCustomDetectionAuditRecord
- mS365DIncidentAuditRecord
- mS365DSuppressionRuleAuditRecord
- msdeCustomCollectionAuditRecord
- msdeGeneralSettingsAuditRecord
- msdeIndicatorsSettingsAuditRecord
- msdeResponseActionsAuditRecord
- msdeRolesSettingsAuditRecord
- mspVectorSearchContentMetadataAuditRecord
- msticNationStateNotificationRecord
- mtpContentMetadata
- multiStageDispositionAuditRecord
- myAnalyticsSettingsAuditRecord
- noisyAlertPolicyAuditRecord
- officeNativeAuditRecord
- omePortalAuditRecord
- onDemandExchangeClassification
- onDemandSharePointClassificationAuditRecord
- oneDriveAuditRecord
- onPremisesFileShareScannerDlpAuditRecord
- onPremisesSharePointScannerDlpAuditRecord
- organizationalDataInM365AuditRecord
- outlookCopilotAutomationAuditRecord
- owaGetAccessTokenForResourceAuditRecord
- p4aiAssessmentCategoryRecord
- p4aiAssessmentFabricScannerRecord
- p4aiAssessmentLocationResultRecord
- p4aiAssessmentRecord
- p4AiDagSitePermissionsRecord
- p4AIRiskScoreRecord
- peopleAdminSettingsAuditRecord
- peopleSkillsAdmin
- peopleSkillsUser
- physicalBadgingSignalAuditRecord
- placesDirectoryAuditRecord
- plannerChatMessageAuditRecord
- plannerChatMessageListAuditRecord
- plannerCopyPlanAuditRecord
- plannerCustomFieldDefinition
- plannerCustomFieldDefinitionList
- plannerDependency
- plannerDependencyList
- plannerGoalAuditRecord
- plannerGoalListAuditRecord
- plannerPlanAuditRecord
- plannerPlanListAuditRecord
- plannerPlanSensitivityLabelAuditRecord
- plannerRosterAuditRecord
- plannerRosterSensitivityLabelAuditRecord
- plannerTaskAuditRecord
- plannerTaskListAuditRecord
- plannerTenantSettingsAuditRecord
- policyConfigChangeAuditRecord
- powerAppsAuditAppRecord
- powerAppsAuditPlanRecord
- powerAppsAuditResourceRecord
- powerBiAuditRecord
- powerBiDlpAuditRecord
- powerPagesSiteAuditRecord
- powerPlatformAdminDlpAuditRecord
- powerPlatformAdminEnvironmentAuditRecord
- powerPlatformAdministratorActivityRecord
- powerPlatformLockboxResourceAccessRequestAuditRecord
- powerPlatformLockboxResourceCommandAuditRecord
- powerPlatformServiceActivityAuditRecord
- powerPlatformTenantIsolationRecord
- privacyDataMatchAuditRecord
- privacyDataMinimizationRecord
- privacyDigestEmailRecord
- privacyOpenAccessAuditRecord
- privacyPortalAuditRecord
- privacyRemediationActionRecord
- privacyRemediationRecord
- privaPrivacyAssessmentOperationRecord
- privaPrivacyConsentOperationRecord
- projectAuditRecord
- projectForTheWebAssignedToMeSettingsAuditRecord
- projectForTheWebProjectAuditRecord
- projectForTheWebProjectSettingsAuditRecord
- projectForTheWebRoadmapAuditRecord
- projectForTheWebRoadmapItemAuditRecord
- projectForTheWebRoadmapSettingsAuditRecord
- projectForTheWebTaskAuditRecord
- publicFolderAuditRecord
- purviewInsiderRiskAlertsRecord
- purviewInsiderRiskCasesRecord
- purviewMCRecommendationRecord
- purviewPostureAgentAuditRecord
- quarantineAuditRecord
- recordsManagementAuditRecord
- reportSubmission
- reportSubmissionResultDetail
- restrictedModeAuditRecord
- retentionPolicyAuditRecord
- rtiOperationsAgentAuditRecord
- sbpConfigurationEventRecord
- sbpUsageEventRecord
- scoreEvidence
- scorePlatformGenericAuditRecord
- scriptRunAuditRecord
- searchAuditRecord
- securityComplianceAlertRecord
- securityComplianceCenterEOPCmdletAuditRecord
- securityComplianceInsightsAuditRecord
- securityComplianceRBACAuditRecord
- securityComplianceUserChangeAuditRecord
- securityCopilotIdentityManagementAuditRecord
- securityDevelopmentLifecycleAILogAuditRecord
- sensitiveInfoRemediationAgentDataRecord
- sensitivityLabelActionAuditRecord
- sensitivityLabeledFileActionAuditRecord
- sensitivityLabelPolicyMatchAuditRecord
- sentinelAIToolAuditRecord
- sentinelGraphAuditRecord
- sentinelJobAuditRecord
- sentinelKQLOnLakeAuditRecord
- sentinelLakeDataOnboardingAuditRecord
- sentinelLakeEncryptionAuditRecord
- sentinelLakeOnboardingAuditRecord
- sentinelNotebookOnLakeAuditRecord
- sentinelPackageAuditRecord
- sharePointAppPermissionOperationAuditRecord
- sharePointAuditRecord
- sharePointCommentOperationAuditRecord
- sharePointContentSecurityPolicyAuditRecord
- sharePointContentTypeOperationAuditRecord
- sharePointESignatureAuditRecord
- sharePointFieldOperationAuditRecord
- sharePointFileArchivePolicy
- sharePointFileOperationAuditRecord
- sharePointListItemOperationAuditRecord
- sharePointListOperationAuditRecord
- sharePointSharingOperationAuditRecord
- skypeForBusinessCmdletsAuditRecord
- skypeForBusinessPSTNUsageAuditRecord
- skypeForBusinessUsersBlockedAuditRecord
- sonarDetonationContentMetadata
- sonarDetonationEntityAuditRecord
- sonarFileDetonationEntityAuditRecord
- sonarSubmissionEntityAuditRecord
- sonarUrlDetonationEntityAuditRecord
- sparkCoreCustomLivePoolRecord
- submissionEntityAuditRecord
- supervisoryReviewDayXInsightsAuditRecord
- syntheticMediaDetectionEvent
- syntheticProbeAuditRecord
- teamCopilotInteractionAuditRecord
- teamsEasyApprovalsAuditRecord
- teamsEvalDataHubAdminOperationAuditRecord
- teamsEvalDataHubDataAccessAuditRecord
- teamsEvalDataHubPermissionChangeAuditRecord
- teamsHealthcareAuditRecord
- teamsUpdatesAuditRecord
- tenantAllowBlockListAuditRecord
- threatFinderAuditRecord
- threatIntelligenceAtpContentData
- threatIntelligenceExportAuditRecord
- threatIntelligenceMailData
- threatIntelligenceObjectAuditRecord
- threatIntelligenceUrlClickData
- todoAuditRecord
- trainableClassifierAuditRecord
- uamOperationAuditRecord
- unifiedGroupAuditRecord
- unifiedSimulationMatchedItemAuditRecord
- unifiedSimulationSummaryAuditRecord
- universalPrintManagementAuditRecord
- universalPrintPrintJobAuditRecord
- universalPrintSecureScan
- urbacAssignmentAuditRecord
- urbacEnableStateAuditRecord
- urbacRoleAuditRecord
- userTrainingAuditRecord
- usxWorkspaceOnboardingAuditRecord
- vfamCreatePolicyAuditRecord
- vfamDeletePolicyAuditRecord
- vfamUpdatePolicyAuditRecord
- vivaAmplifyAuditRecord
- vivaEngageEventsAuditRecord
- vivaEngageNetworkAssociationAuditRecord
- vivaEngageSegmentAuditRecord
- vivaGlintAdvancedConfigurationAuditRecord
- vivaGlintAgenticCampaignAuditRecord
- vivaGlintClientConfiguration
- vivaGlintDataRetention
- vivaGlintFeedbackProgramAuditRecord
- vivaGlintOrganizationalDataAuditRecord
- vivaGlintPulseProgramAuditRecord
- vivaGlintPulseProgramRespondentRateAuditRecord
- vivaGlintQuestionAuditRecord
- vivaGlintRoleAuditRecord
- vivaGlintRubiconAuditRecord
- vivaGlintSupportAccessAuditRecord
- vivaGlintSystemAuditRecord
- vivaGlintUserAuditRecord
- vivaGlintUserGroupAuditRecord
- vivaGlintVivaInsightsIntegration
- vivaGoalsAuditRecord
- vivaLearningAdminAuditRecord
- vivaLearningAuditRecord
- vivaPulseAdminAuditRecord
- vivaPulseOrganizerAuditRecord
- vivaPulseReportAuditRecord
- vivaPulseResponseAuditRecord
- wdatpAlertsAuditRecord
- webContentFilteringAuditRecord
- windows365CustomerLockboxAuditRecord
- workIQAdminActivity
- workplaceAnalyticsAuditRecord
- yammerAuditRecord
- yammerUserHidingAuditRecord