I am looking for where various Teams.Voice admin actions are logged, or how the actions can be made to publish events. For example; Admin [ assigns | unassigns ] a phone number [ to | from ] a User/Call-Q/ConferenceRm/Resource/etc > Event published / action & detail. Admin [ creates | changes | deletes ] a Call-Q > Event published / action & detail New phone numbers are added to Inventory > Event published .... Phone numbers are Release (back to Microsoft/Carrier) > Event published .... I assume these actions (and more) are logged somewhere in the Azure fabric. We should be able to catch those & pump them into Event Grid & take it from there. My problem ... Where are such Teams.Voice actions logged so we can build triggers from them? Thanks in advance! /Paul

You will find them in the Unified audit log: https://learn.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance?view=o365-worldwide If you want to access it programmatically, use the Management activity API: https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-reference

Teams Voice Events: Phone Number Assigned/Unassigned

Paul Rarey 21

I am looking for where various Teams.Voice admin actions are logged, or how the actions can be made to publish events.
For example;

Admin [ assigns | unassigns ] a phone number [ to | from ] a User/Call-Q/ConferenceRm/Resource/etc > Event published / action & detail.
Admin [ creates | changes | deletes ] a Call-Q > Event published / action & detail
New phone numbers are added to Inventory > Event published ....
Phone numbers are Release (back to Microsoft/Carrier) > Event published ....

I assume these actions (and more) are logged somewhere in the Azure fabric. We should be able to catch those & pump them into Event Grid & take it from there.

My problem ... Where are such Teams.Voice actions logged so we can build triggers from them?

Thanks in advance!
/Paul

Prasad-MSFT 6,111 Reputation points Microsoft Vendor

2022-03-14T12:19:31.69+00:00

There doesn't seem to be any other way where we can find those logs apart from Unified audit log(https://learn.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance?view=o365-worldwide) as mentioned.

1 answer

Vasil Michev 100.2K Reputation points MVP

2022-03-07T06:18:13.277+00:00

You will find them in the Unified audit log: https://learn.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance?view=o365-worldwide
If you want to access it programmatically, use the Management activity API: https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-reference
Please sign in to rate this answer.

1 person found this answer helpful.
Yuki Sun-MSFT 41,016 Reputation points

2022-03-07T09:47:33.41+00:00

H i@Paul Rarey ，

Where are such Teams.Voice actions logged

Agree with michev on that these admin activities can be found in the audit logs in Microsoft 365.

I tried assigning a phone number to a user via Teams admin center and noticed that the event was logged as below:

So you can search for activity type "Changed setting by ConfigApi service" and note the item including strings like "telephonenumber"

Paul Rarey 21 Reputation points

2022-03-11T03:59:40.62+00:00

Hello Michev & YukiSun,
Good to know the actions/events I noted are available in Audit logs. I read through the URLs provided and a few of the reference pages in them.
Findings are:

Audit logs are periodically dropped as Blobs. These are a bit different than Activity logs, which are more transactional in nature.

MS doc Troubleshooting O365 Management API has the following FAQ items

Q1: What is the maximum time I will have to wait before a notification is sent about a given Office 365 event?
A1: There is no guaranteed maximum latency for notification delivery (in other words, there is no SLA). Typically, most notifications are sent within one hour of the event. Often the latency is much shorter, but this period might be longer since this varies from workload to workload.

Q2 Aren't webhook notifications more immediate?
A2: No. Recently, there have been longer wait times for notifications when using a webhook compared to querying the API directly with the /content operation.

The above leads me to ask: Where are the Activity logs relevant to the Events I noted?
Activity logs are more "immediate" with updates from admin tasks done in Teams Admin Center (Voice), MSTeams PS Cmdlets or Teams GraphAPIs.
Activity logs typically have a connecter to Event Grid. Which is much easier to deal with than Audit log webhooks.
Any pointers to where Activity logs might be would be greatly appreciated!

risolis 8,711 Reputation points

2022-03-11T06:21:34.953+00:00

https://learn.microsoft.com/en-us/microsoftteams/teams-activity-reports

https://learn.microsoft.com/en-us/microsoftteams/teams-analytics-and-reports/teams-reporting-reference

https://learn.microsoft.com/en-us/microsoftteams/manage-your-network-topology

risolis 8,711 Reputation points

2022-03-11T06:23:37.21+00:00

@Paul Rarey

Yuki Sun-MSFT 41,016 Reputation points

2022-03-14T07:51:21.47+00:00

Hi @Paul Rarey ,

Where are the Activity logs relevant to the Events I noted?

I tried searching around but cannot find any public available document stating this. Considering that the tag "office-teams-windows-itpro" mainly focus on general questions about the Teams desktop client, I'll add the “office-teams-app-dev” and hopefully their community members can help look into your queries as well.
Sign in to comment

Share via

Teams Voice Events: Phone Number Assigned/Unassigned

1 answer