Get directoryAudit

Namespace: microsoft.graph

Get a specific Azure Active Directory audit log item. This includes an audit log item generated by various services within Azure Active Directory like user, application, device and group management, privileged identity management (PIM), access reviews, terms of use, identity protection, password management (self-service and admin password resets), self-service group management, and so on.


One of the following permissions is required to call this API. To learn more, including how to choose permissions, see Permissions.

Permission type Permissions (from least to most privileged)
Delegated (work or school account) AuditLog.Read.All and Directory.Read.All
Delegated (personal Microsoft account) Not supported
Application AuditLog.Read.All and Directory.Read.All


This API has a known issue and currently requires consent to both the AuditLog.Read.All and Directory.Read.All permissions.

HTTP request

GET /auditLogs/directoryAudits/{id}

Optional query parameters

This method supports OData query parameters to help customize the response. For details about how to use these parameters, see OData query parameters.

Request headers

Name Description
Authorization Bearer {code}

Request body

Do not supply a request body for this method.


If successful, this method returns a 200 OK response code and directoryAudit object in the response body.



Here is an example of the request.



Here is an example of the response.

Note: The response object shown here might be shortened for readability.

HTTP/1.1 200 OK
Content-type: application/json

  "@odata.context": "$metadata#auditlogs/directoryaudits",
  "value": [{
		"id": "id",
		"category": "UserManagement",
		"correlationId": "da159bfb-54fa-4092-8a38-6e1fa7870e30",
		"result": "success",
		"resultReason": "Successfully added member to group",
		"activityDisplayName": "Add member to group",
		"activityDateTime": "2018-01-09T21:20:02.7215374Z",
		"loggedByService": "Core Directory",
		"initiatedBy": {
			"user": {
				"id": "728309ae-1a37-4937-9afe-e35d964db09b",
				"displayName": "Audry Oliver",
				"userPrincipalName": "",
				"ipAddress": ""
			"app": null
		"targetResource": [{
			"id": "ef7e527d-6c92-4234-8c6d-cf6fdfb57f95",
			"displayName": "",
			"Type": "Group",
			"modifiedProperties": [{
				"displayName": "Action Client Name",
				"oldValue": null,
				"newValue": "DirectorySync" 
			"groupType": "unifiedGroups"
		}, {
			"id": "1f0e98f5-3161-4c6b-9b50-d488572f2bb7",
			"displayName": null,
			"Type": "User",
			"modifiedProperties": [],
			"userPrincipalName": ""
		"additionalDetails": [{
			"key": "Additional Detail Name",
			"value": "Additional Detail Value"