Microsoft 365

Download 28
Last updated May 22, 2022

o365-azure-ad-logs

Fetch Azure active directory logs using Office 365 Management API

o365-azure-ad-logs [profile=PROFILE] [duration=NUM{mon|w|d|h|m|s}] [from=yyyyMMddHHmmss] [to=yyyyMMddHHmmss]
profile=PROFILE
Office 365 connect profile name
duration=NUM{mon|w|d|h|m|s}
Scan only recent data. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example, '10s' means data from 10 seconds earlier.
from=yyyyMMddHHmmss
Start time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
to=yyyyMMddHHmmss
End time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.

Output Fields

FieldTypeNameDescription
_timeDateTime
profileStringConnect profileThe identifier of Office 365 connect profile
workloadStringWorkloade.g. AzureActiveDirectory
client_ipIP addressClient IP
actor_ipIP addressActor IP
user_idStringUser IDe.g. xeraph@logpresso.com
operationStringOperatione.g. UserLoggedIn, UserLoginFailed, Add service principal., Update user., Update device.
logon_errorStringLogon errore.g. InvalidUserNameOrPassword, PasswordResetRegistrationRequiredInterrupt, AuthenticationFailedSasError, InvalidPasswordExpiredPassword, InvalidReplyTo, SsoArtifactRevoked, UserStrongAuthClientAuthNRequiredInterrupt
object_idStringObject IDe.g. 00000002-0000-0000-c000-000000000000
result_statusStringResult statuse.g. Success, Failed
record_typeIntegerRecord typee.g. 8 (Update), 15 (Login)
user_typeIntegerUser typee.g. 0 (User), 4 (Service)
user_keyStringUser keyGUID, Email address or Not Available
versionIntegerVersione.g. 1
idStringIDGUID format
org_idStringTenant ID
app_idStringApp ID
azure_ad_event_typeStringAzure AD event typee.g. 1
actor_context_idStringActor context IDGUID format
target_context_idStringTarget context IDGUID format
inter_systems_idStringInter systems IDGUID format
intra_system_idStringIntra systems IDGUID format
support_ticket_idStringSupport ticket ID
actorListActorElements with id and type properties
targetListTargetElements with id and type properties
modified_propertiesListModified propertiesElements with name, old_value, and new_value properties
extended_propertiesListExtended propertiesElements with name and value properties
device_propertiesListDevice propertiesElements with name and value properties