Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Important
This feature is in Beta. To use it, a workspace admin must turn on Lakeflow Connect for Microsoft 365 Unified Audit Logs from the Previews page. See Manage Azure Databricks previews.
The managed Microsoft 365 Unified Audit Logs connector in Lakeflow Connect ingests unified audit events from Microsoft Entra ID, Exchange, SharePoint, and other Microsoft 365 workloads into Azure Databricks.
The connector uses the Microsoft 365 Management Activity API to ingest append-only audit events. It doesn't ingest Outlook messages or SharePoint files.
Feature availability
| Feature | Availability |
|---|---|
| UI-based pipeline authoring |  Not supported |
| API-based pipeline authoring |  Supported |
| Declarative Automation Bundles | Supported |
| Incremental ingestion | Supported |
| Unity Catalog governance | Supported |
| Orchestration using Databricks Workflows | Supported |
| API-based column selection and deselection | Supported |
| API-based row filtering | Not supported |
| SCD Type 2 | Not supported Microsoft 365 unified audit events are append-only. |
| Automated schema evolution: New and deleted columns | Supported |
| Automated schema evolution: Data type changes | Not supported |
| Automated schema evolution: Column renames | Supported Treated as a new column (new name) and deleted column (old name). |
Authentication methods
| Authentication method | Availability |
|---|---|
| OAuth U2M | Not supported |
| OAuth M2M | Supported A Microsoft Entra application with a client ID, client secret, and Office 365 Management API application permissions. |
| Basic authentication (username/password) | Not supported |
What to know before you start
Note
Before starting, review the Azure Databricks user persona, supported interfaces, ingestion frequency, and common patterns.
Start ingesting from Microsoft 365
- Configure Microsoft 365 for ingestion (Microsoft 365 and Entra admins). Enable unified auditing and create a Microsoft Entra application for Azure Databricks.
- Create a Unity Catalog connection (Admins). Create a connection in Catalog Explorer so pipeline authors don't need direct access to the credentials.
- Create an ingestion pipeline (Admins or non-admins). Use Declarative Automation Bundles or a Azure Databricks notebook to create a pipeline from an existing connection.