Microsoft Entra ID - Provisioning logs API

Question

Hello Team,

Does provisioning log API returns actor details in the event? Could you please let us know.

(https://graph.microsoft.com/v1.0/auditLogs/provisioning)

Reference: https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-provisioning-logs

Thanks,
Ravi P.

Answer 1

Hi @Ron Weasley

Thank you for posting this in Microsoft Q&A.

A provisioning log API returns actor (initiated) details in the event logs but that entries in the provisioning logs are system generated, and that events triggered by the system will show an empty string for the id property of the actor and type property will be set to "System". This indicates that the event was triggered by a system process, rather than by a user or application.

You will see the actor details in the provisioning logs as below.

Hope this helps. Do let us know if you any further queries.

Thanks,

Navya.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.