This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(86.4, 16%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMD%3C/text%3E%3C/svg%3E)
Hi
Is it possible to view audit logs for specific graph API call based on unique id (for example update user operation)?
There is a possibility to get directory audit to view graph api exectuted operations by:
GET /auditLogs/directoryaudits
GET /auditLogs/directoryAudits/{id}
The response contains unique IDs:
I've made sure that request_id / corellation_id which is returned with response during graph api call is different to audit log's corellationId and couldn't be used to find audit logs for those api call.
https://learn.microsoft.com/en-us/graph/api/user-update?view=graph-rest-1.0&tabs=http
Is this any way to keep data during request and use it to find audit data for it later or any alternative way?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(3.2, 35%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESD%3C/text%3E%3C/svg%3E)
To address your issue I have updated some users in my trial tenant account and I am able to get that in UserManagement category in AuditLog Graph API.
As you can see I am getting "Id" for that particular Log. Use this Id in Get Audit Log Graph API. Please refer below screenshot.
Hope this helps.
If the answer is helpful, please click "Accept Answer" and kindly upvote. If you have extra questions about this answer, please click "Comment".
Thanks for an answer.
Yeah, this works, but this is not quite exactly what I am looking for.
I would like to understand am I able to call graph API operation: for example : UpdateUser
An then find in all scope of UserManagement logs which contains huge amount of different "UpdateUser" operations the specific one which is related to specific UpdateUser call. I don't know its id cause I don't have any link between the graph api request / response and the audit log.
Hypothetically, I wanted to find the way like:
In your example you executed the operation, found audit log manually cause you know that it is connected to your operation and saved its id.
As per my research this functionality which you are looking is not currently available. If you are looking to get this feature/functionality with MS Graph API, you can submit a feature request idea using this support link, which will be monitored by Microsoft team and make the enhancements to Microsoft Graph APIs. I will also upvote for you.
Also as a workaround you can use filter to get more personalized result. Please refer to the below sample screenshot.
Hope this helps!
If the answer is helpful, please click "Accept Answer" and kindly upvote. If you have extra questions about this answer, please click "Comment".