Low-Level event log extraction

Question

Hello everyone.

This is probably a tough one(?).

While trying to gather low-level event logs of user activity in MS Teams (e.g., Bob postet a chatMessage in chatChannel:NiceChannel at 2023-04-25T17:12.239+4) I started looking in MS Graph, however I could only find reports that contain aggregated data. Since I want "flat" event log data I continued searching and stumbled across this thread (hence the "Azure Monitor" tag) which references the Azrue APIs. Accordingly, I created an access token - so far so good. But now I am getting nowhere as there are some hickups regarding access rights, subscriptions, etc.

I currently have three MS accounts (private, organization, sandbox).

Private: I don't have an azure subscription and I don't use teams.
Organization: I don't have access rights and probably won't get them (although we use teams).
Sandbox: The "subscription" list is empty to I can't send any queries, although there probably is the data I want.

Is there any way to get event log data from the sandbox? I would like to find out in what form such data is available and use it for BI analyses.

Best
Martin

Answer 1

Have you seen this article? https://learn.microsoft.com/en-us/microsoft-365/compliance/audit-teams-audit-log-events?view=o365-worldwide#teams-activities?WT.mc_id=modinfra-8876-socuff >

There is a link there to the schema, this allows you to see the "data form", when you get the right access to your sandbox.
https://learn.microsoft.com/en-us/microsoft-365/compliance/audit-teams-audit-log-events?view=o365-worldwide#office-365-management-activity-api

Answer 2

Getting MS Teams log is possible.

You have to:

• Enable Unified Audit Log in Compliance Center
• Create Application (with redirect Uri [e.g. "https://127.0.0.1"])
• Secret and save "value"
• Set API-Permissions (ActivityFeed.Read [, ActivityFeed.ReadDlp])
• Get "code"
  • https://login.windows.net/common/oauth2/authorize?response_type=code&resource=https%3A%2F%2Fmanage.office.com&client_id=YourClientID&redirect_url=https://127.0.0.1
  • "code" is part of the url you are directed to
• Get access token (bearer token)
  • https://login.windows.net/common/oauth2/token
    • attributes:
      • client_id = id of your application (client id)
      • redirect_uri = "https://127.0.0.1" (example)
      • client_secret = value of your Azure secret
      • grant_type = "authorization_code"
      • code = code from previous step
      • resource = "https://manage.office.com"
    • I used postman
• Enable Service Subscription (bearer token for auth)
  • https://manage.office.com/api/v1.0/YourTenantID/activity/feed/subscriptions/start?contentType=Audit.General
  • I used Postman
• Get content blob urls for Audit.General
  • https://manage.office.com/api/v1.0/YourTenantID/activity/feed/subscriptions/content?contentType=Audit.General
• Query data from blob urls

More details can be found here.