I'm receiving incomplete / invalid JSON responses for certain Graph requests in the new AuditLog beta

Michael Goodman 10 Reputation points
2024-04-04T16:22:04.1233333+00:00

I have used the https://graph.microsoft.com/beta/security/auditLog/queries beta API URI to create three different AuditLogQuery searches. All three were created in the same way, and all three succeeded.

I can make requests to https://graph.microsoft.com/beta/security/auditLog/queries/f48207db-1a74-4735-9b81-2206bb274b5b/records (using the relevant query ID) to fetch records, and follow the @odata.nextLink values to handle pageified data.

However, for one of my three searches, when I make my request to fetch records, I receive an incomplete JSON object for the first page. Requesting the second page via the nextLink does NOT provide me with completing JSON. i.e. combining page 1 and 2 does not "complete" the first response's JSON.

I've included below an anonymised version of the last object in the value array, and you can see that it is incomplete:

{
            "id": "2fec18db-25c7-f171-ee53-1c2313e25dce",
            "createdDateTime": "2024-01-25T17:20:43Z",
            "auditLogRecordType": "Yammer",
            "operation": "O365SyncAdminUserPromotion",
            "organizationId": "ce88f12e-332b-41cc-be1d-664529afd86d",
            "userType": "Regular",
            "userId": "10032001121ddbf8",
            "service": "Yammer",
            "objectId": "NoObjectIdSpecified",
            "userPrincipalName": "steve@acme.onmicrosoft.com",
            "clientIp": null,
            "administrativeUnits": [
                ""
            ]{
                "error": {
                    "code": "UnknownError",
                    "message": "Unexpected Jsontoken. Check response for property value[56].auditData.ActorYammerUserId",
                    "innerError": {
                        "date": "2024-04-04T16:07:31",
                        "request-id": "25ce8ee1-4662-442a-b71a-aa9ac33d85cb",
                        "client-request-id": "25ce8ee1-4662-442a-b71a-aa9ac33d85cb"
                    }
                }
            }
Microsoft Graph
Microsoft Graph
A Microsoft programmability model that exposes REST APIs and client libraries to access data on Microsoft 365 services.
10,645 questions
{count} votes