Admin activity Succeeded
Run 50 · queued · finished
Requests to Microsoft
12
1 endpoint
Throttled
0
Microsoft never said “too many”
Time waiting
none
for retries and Microsoft's limits
Numbers recorded
- admin_activity.app_credential_changes
- 4
- admin_activity.ca_changes
- 3
- admin_activity.events
- 19
- admin_activity.role_changes
- 3
Items collected
| Endpoint | Microsoft's limit | Requests | Throttled | Failed | Waiting | Units |
|---|---|---|---|---|---|---|
| /auditLogs/directoryAudits v1.0 | Sign-in and audit logs5 requests per 10 seconds, per tenant | 12 | – | – | – | – |
| activity | actor | actor_type | area | ca_disabled | category | credential_added | detail | ip | kind | more_targets | reason |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Consent to application | admin@northwindtraders.example | user | Apps | False | ApplicationManagement | False | Admin consent for everyone: Mail.Read User.Read | 203.0.113.40 | consent | 0 | |
| Add app role assignment to service principal | admin@northwindtraders.example | user | Apps | False | ApplicationManagement | False | Mail.ReadWrite on Microsoft Graph | 203.0.113.40 | app_role | 0 | |
| Update conditional access policy | admin@northwindtraders.example | user | Conditional Access | True | Policy | False | On → Off | 203.0.113.40 | ca | 0 | |
| Add conditional access policy | admin@northwindtraders.example | user | Conditional Access | False | Policy | False | On | 203.0.113.40 | ca | 0 | |
| Delete conditional access policy | admin@northwindtraders.example | user | Conditional Access | False | Policy | False | 203.0.113.40 | ca | 0 | ||
| Update application – Certificates and secrets management | admin@northwindtraders.example | user | Apps | False | ApplicationManagement | True | Added certificate | 203.0.113.40 | app_credential | 0 | |
| Update application – Certificates and secrets management | admin@northwindtraders.example | user | Apps | False | ApplicationManagement | False | Removed secret | 203.0.113.40 | app_credential | 0 | |
| Add service principal credentials | Contoso Automation | app | Apps | False | ApplicationManagement | True | Credential added | app_credential | 0 | ||
| Set domain authentication | mallory.price@northwindtraders.example | user | Domains | False | DirectoryManagement | False | 203.0.113.9 | federation | 0 | ||
| Verify domain | admin@northwindtraders.example | user | Domains | False | DirectoryManagement | False | 203.0.113.40 | domain | 0 | ||
| Add partner to company | Partner Center | app | Partners | False | DirectoryManagement | False | partner | 0 | |||
| Add member to role | admin@northwindtraders.example | user | Admin roles | False | RoleManagement | False | Global Administrator | 203.0.113.40 | role_grant | 0 | |
| Add eligible member to role in PIM completed (permanent) | admin@northwindtraders.example | user | Admin roles | False | RoleManagement | False | Exchange Administrator | 203.0.113.40 | role_grant | 0 | |
| Remove member from role | admin@northwindtraders.example | user | Admin roles | False | RoleManagement | False | Global Administrator | 203.0.113.40 | role_removal | 0 | |
| Add member to role | mallory.price@northwindtraders.example | user | Admin roles | False | RoleManagement | False | Global Administrator | 203.0.113.9 | role_grant | 0 | Insufficient privileges |
| Reset user password | admin@northwindtraders.example | user | Accounts | False | UserManagement | False | 203.0.113.40 | password_reset | 0 | ||
| Delete user | admin@northwindtraders.example | user | Accounts | False | UserManagement | False | 203.0.113.40 | user_delete | 2 | ||
| Admin registered security info | admin@northwindtraders.example | user | Accounts | False | UserManagement | False | 203.0.113.40 | security_info | 0 | ||
| Update application – Certificates and secrets management | admin@northwindtraders.example | user | Apps | False | ApplicationManagement | True | Added certificate | 203.0.113.40 | app_credential | 0 |
Log
17:16:13 INFO Starting Admin activity for Northwind Traders 17:16:13 INFO Read 23 directory audit events from Microsoft (0 new) 17:16:13 INFO Stored 1 audit_window object 17:16:13 INFO Stored 19 admin_event objects 17:16:13 INFO Finished: succeeded