AuditLogsQuery-OneDrive.Read.All

Allows the app to read and query audit logs from OneDrive workload, on behalf of a signed-in user.

Merill's Note

For an app to access data in Microsoft Graph, the user or administrator must grant it the permissions it needs. This article lists all the Microsoft Graph APIs and your tenant data that can be accessed by the application (vendor/developer) if you consent to the AuditLogsQuery-OneDrive.Read.All permission.

If you need to create an audit report of the permissions granted to all the apps in your tenant, you can run the Export-MsIdAppConsentGrantReport command. See How To: Run a quick OAuth app audit of your tenant

Category	Application	Delegated
Identifier	8a169a81-841c-45fd-ad43-96aede8801a0	4a72c235-a50d-4870-b598-fd88fd1fa074
DisplayText	Read audit logs data from OneDrive workload	Read audit logs data from OneDrive workload
Description	Allows the app to read and query audit logs from OneDrive workload, without a signed-in user	Allows the app to read and query audit logs from OneDrive workload, on behalf of a signed-in user.
AdminConsentRequired	Yes	Yes

Graph Methods

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	GET /security/auditLog/queries
	GET /security/auditLog/queries/{auditLogQueryId}/records
	POST /security/auditLog/queries

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	GET /security/auditLog/queries
	GET /security/auditLog/queries/{auditLogQueryId}
	GET /security/auditLog/queries/{auditLogQueryId}/records
	POST /security/auditLog/queries

→ Command supports delegated access (access on behalf of a user)
→ Command supports app-only access (access without a user)

	Commands
	Get-MgSecurityAuditLogQuery
	New-MgSecurityAuditLogQuery

→ Command supports delegated access (access on behalf of a user)
→ Command supports app-only access (access without a user)

	Commands
	Get-MgBetaSecurityAuditLogQuery
	Get-MgBetaSecurityAuditLogQueryRecord
	New-MgBetaSecurityAuditLogQuery

Resources

Granting this permission allows the calling application to access (and/or update) the following information in your tenant.

auditLogQuery
auditLogRecord

Graph reference: auditLogQuery

Property	Type	Description
administrativeUnitIdFilters	String collection	The collection of administrative unit IDs to filter on.
approximateReturnedRecordCount	Int64	The approximate number of records retrieved by the query. This value can be higher or lower than recordCountLimit due to distributed counting. Read-only.
displayName	String	The display name of the audit log query.
filterEndDateTime	DateTimeOffset	The end date and time of the audit log query filter.
filterStartDateTime	DateTimeOffset	The start date and time of the audit log query filter.
id	String	The unique identifier for the audit log query. Inherited from entity.
ipAddressFilters	String collection	The collection of IP addresses to filter on.
isRecordCountLimitExceeded	Boolean	Indicates whether the query exceeded the per-search record-count limit. The default value is `false`. A value of `true` is authoritative and isn't derived from approximateReturnedRecordCount. Read-only.
keywordFilter	String	Free text to match against the non-indexed content of each record: the workload-specific properties inside auditData, including its `AppAccessContext` object. The indexed common-schema properties, such as the operation name, aren't matched by keyword; use their own filters, such as operationFilters, for those.
objectIdFilters	String collection	The collection of object IDs to filter on.
operationFilters	String collection	The collection of operations to filter on.
recordCountLimit	Int64	The record-count threshold used to limit query result retrieval. Read-only.
recordTypeFilters	microsoft.graph.security.auditLogRecordType collection	The collection of record types to filter on.
serviceFilters	String collection	The collection of services to filter on.
status	microsoft.graph.security.auditLogQueryStatus	The status of the audit log query. Possible values are: `notStarted`, `running`, `succeeded`, `failed`, `cancelled`, `unknownFutureValue`.
userPrincipalNameFilters	String collection	The collection of user principal names to filter on.

Graph reference: auditLogRecord

Property	Type	Description
administrativeUnits	String collection	The collection of administrative units associated with the record.
auditData	microsoft.graph.security.auditData	The audit data associated with the record.
auditLogRecordType	microsoft.graph.security.auditLogRecordType	The type of the audit log record.
clientIp	String	The IP address of the client that performed the activity.
createdDateTime	DateTimeOffset	The date and time when the activity was performed.
id	String	The unique identifier for the audit log record. Inherited from entity.
objectId	String	The identifier of the object that was affected by the activity.
operation	String	The name of the activity that was performed.
organizationId	String	The GUID of the organization's Microsoft 365 tenant.
service	String	The Microsoft 365 service where the activity occurred.
userId	String	The identifier of the user, system account, service, or application that performed the activity.
userPrincipalName	String	The user principal name of the user who performed the activity.
userType	microsoft.graph.security.auditLogUserType	The type of user who performed the activity. Possible values are: `regular`, `reserved`, `admin`, `dcAdmin`, `system`, `application`, `servicePrincipal`, `customPolicy`, `systemPolicy`, `partnerTechnician`, `guest`, `unknownFutureValue`.

Table of Contents

AuditLogsQuery-OneDrive.Read.All

Graph Methods

Resources