Microsoft Graph Activity Log

Question

Hi--I have a compromised account and would like to see the past MS Graph Activity Log. I just started an upgraded Azure subscription...I was wondering if I did the steps to create a MS Graph Activity Log now, would I be able to see past history....or just activity going forward? Thank you!

Answer 1

Microsoft Graph activity logs are an audit trail of all HTTP requests that the Microsoft Graph service received and processed for a tenant. Tenant administrators can enable the collection and configure downstream destinations for these logs using diagnostic settings in Azure Monitor.

However, the logs only start recording from the point you enable them. They do not provide historical data prior to their activation. Therefore, if you enable the MS Graph Activity Log now, you would only be able to see the activity going forward, not the past history.

Remember, to access the Microsoft Graph activity logs, you need a Microsoft Entra ID P1 or P2 tenant license in your tenant and an administrator role. You also need an Azure subscription with one of the log destinations configured.

I hope this helps! If you have any more questions, feel free to ask.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".