How to get the user activity logs for applications connected with Entra ID?

Question

I am able to retrieve the last sign in times for applications for each user in my entra id using audit logs from the graph api, but can't find the logs of users's activity.

Note that I am already able to retrieve the sign in logs using

Answer 1

Hello Pratham , Welcome to MS Q&A

To retrieve user activity logs in Microsoft Entra ID using the Graph API, you can use the following query

GET https://graph.microsoft.com/v1.0/auditLogs/signIns

This query will return the sign-in logs for users. If you need to filter the logs for specific activities, you can add query parameters. For example, to filter logs for a specific user, you can use:

GET https://graph.microsoft.com/v1.0/auditLogs/signIns?$filter=userPrincipalName eq 'user@example.com'

To execute this query, you can use tools like Microsoft Graph Explorer or any HTTP client.

For more detailed instructions and examples, you can refer to the Microsoft documentation on accessing activity logs through the Microsoft Graph API:

• How to access activity logs in Microsoft Entra ID
• How to analyze activity logs with Microsoft Graph

These resources provide comprehensive guidance on how to construct and execute queries to retrieve user activity logs.

Pls let me know if you have any questions

Kindly accept answer if it helps

Thanks
Deepanshu