Microsoft 365

Download 28
Last updated May 22, 2022


Fetch Azure active directory logs using Office 365 Management API

o365-azure-ad-logs [profile=PROFILE] [duration=NUM{mon|w|d|h|m|s}] [from=yyyyMMddHHmmss] [to=yyyyMMddHHmmss]
Office 365 connect profile name
Scan only recent data. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example, '10s' means data from 10 seconds earlier.
Start time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
End time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.

Output Fields

profileStringConnect profileThe identifier of Office 365 connect profile
workloadStringWorkloade.g. AzureActiveDirectory
client_ipIP addressClient IP
actor_ipIP addressActor IP
user_idStringUser IDe.g.
operationStringOperatione.g. UserLoggedIn, UserLoginFailed, Add service principal., Update user., Update device.
logon_errorStringLogon errore.g. InvalidUserNameOrPassword, PasswordResetRegistrationRequiredInterrupt, AuthenticationFailedSasError, InvalidPasswordExpiredPassword, InvalidReplyTo, SsoArtifactRevoked, UserStrongAuthClientAuthNRequiredInterrupt
object_idStringObject IDe.g. 00000002-0000-0000-c000-000000000000
result_statusStringResult statuse.g. Success, Failed
record_typeIntegerRecord typee.g. 8 (Update), 15 (Login)
user_typeIntegerUser typee.g. 0 (User), 4 (Service)
user_keyStringUser keyGUID, Email address or Not Available
versionIntegerVersione.g. 1
idStringIDGUID format
org_idStringTenant ID
app_idStringApp ID
azure_ad_event_typeStringAzure AD event typee.g. 1
actor_context_idStringActor context IDGUID format
target_context_idStringTarget context IDGUID format
inter_systems_idStringInter systems IDGUID format
intra_system_idStringIntra systems IDGUID format
support_ticket_idStringSupport ticket ID
actorListActorElements with id and type properties
targetListTargetElements with id and type properties
modified_propertiesListModified propertiesElements with name, old_value, and new_value properties
extended_propertiesListExtended propertiesElements with name and value properties
device_propertiesListDevice propertiesElements with name and value properties