Dataverse and model-driven apps audit
| Operation | Description | Sample | Rule |
|---|---|---|---|
| any | Catch-all for M365-CRM rules matching the RecordType but no specific Operation. | N | Y |
| Access | A record is read, for example via Retrieve or RetrieveMultiple SDK messages (audit_operation picklist value 4). | N | N |
| Archive | A record is moved to long-term archive storage (audit_operation picklist value 115). | N | N |
| Create | A record is created (audit_operation picklist value 1). | N | N |
| Custom | A custom SDK message or plugin-driven operation triggers the audit record (audit_operation picklist value 200). | N | N |
| Delete | A record is deleted (audit_operation picklist value 3). | N | N |
| Restore | A record is restored from archive or backup (audit_operation picklist value 118). | N | N |
| Retain | A record is retained under a Dataverse long term retention policy (audit_operation picklist value 116). | N | N |
| Rollback | A prior Retain operation on a record is rolled back (audit_operation picklist value 117). | N | N |
| Update | A record is updated (audit_operation picklist value 2). | N | N |
| Upsert | A record is created if it does not exist or updated if it does (audit_operation picklist value 5). | N | N |
any: Dataverse and model-driven apps audit (catch-all)
#Description
Catch-all for M365-CRM rules matching the RecordType but no specific Operation.
Detection Fields #
Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.
| Name | Rules | Vendors |
|---|---|---|
Message | 24 detection rules | Kusto |
EntityName | 8 detection rules | Kusto |
UserId | 7 detection rules | Kusto |
ClientIP | 6 detection rules | Kusto |
Fields.Name | 3 detection rules | Kusto |
Name | 3 detection rules | Kusto |
UserAgent | 3 detection rules | Kusto |
Fields | 2 detection rules | Kusto |
watchlist_entries_count | 2 detection rules | Kusto |
CurrentExportRate | 1 detection rule | Kusto |
DataverseActivity_TimeGenerated | 1 detection rule | Kusto |
Entities | 1 detection rule | Kusto |
Entities.Type | 1 detection rule | Kusto |
Fields.Value | 1 detection rule | Kusto |
HistoricalTime | 1 detection rule | Kusto |
InstanceUrl | 1 detection rule | Kusto |
Operation | 1 detection rule | Kusto |
OriginalObjectId | 1 detection rule | Kusto |
Position.Name | 1 detection rule | Kusto |
Position.Value | 1 detection rule | Kusto |
Role.Name | 1 detection rule | Kusto |
SystemUserId | 1 detection rule | Kusto |
Target.Name | 1 detection rule | Kusto |
Value | 1 detection rule | Kusto |
Workload | 1 detection rule | Kusto |
Common Indicators #
Positive field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.
| Field | Kind | Value | Rules | Vendors |
|---|---|---|---|---|
ClientIp (kusto rule field) | is_not_null | | 6 rules | kusto |
Message (kusto rule field) | eq | UserSignIn | 6 rules | kusto |
Message (kusto rule field) | eq | Update | 5 rules | kusto |
Message (kusto rule field) | eq | Create | 2 rules | kusto |
Message (kusto rule field) | eq | Delete | 2 rules | kusto |
Message (kusto rule field) | in | Create | 2 rules | kusto |
Message (kusto rule field) | in | Update | 2 rules | kusto |
EntityName (kusto rule field) | eq | organization | 4 rules | kusto |
EntityName (kusto rule field) | eq | systemuser | 3 rules | kusto |
aws::userAgent (kusto rule field) | is_not_null | | 3 rules | kusto |
DataverseActivity_TimeGenerated (kusto rule field) | cross_field_compare | ExpirationDateTime | 2 rules | kusto |
Value (kusto rule field) | eq | False | 2 rules | kusto |
user (kusto rule field) | ne | unknown | 2 rules | kusto |
watchlist_entries_count (kusto rule field) | gt | 0 | 2 rules | kusto |
ActionType (kusto rule field) | eq | UsbDriveMounted | 1 rule | kusto |
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Kusto #
T0834, T0859, T0871, T1528, T1569T1070T1562
Access
#Description
A record is read, for example via Retrieve or RetrieveMultiple SDK messages (audit_operation picklist value 4).
Archive
#Description
A record is moved to long-term archive storage (audit_operation picklist value 115).
Create
#Description
A record is created (audit_operation picklist value 1).
CustomOperation
#Description
A custom SDK message or plugin-driven operation triggers the audit record (audit_operation picklist value 200).
Delete
#Description
A record is deleted (audit_operation picklist value 3).
Restore
#Description
A record is restored from archive or backup (audit_operation picklist value 118).
Retain
#Description
A record is retained under a Dataverse long term retention policy (audit_operation picklist value 116).
RollbackRetain
#Description
A prior Retain operation on a record is rolled back (audit_operation picklist value 117).
Update
#Description
A record is updated (audit_operation picklist value 2).
Upsert
#Description
A record is created if it does not exist or updated if it does (audit_operation picklist value 5).
References #
M365 audit records use different field names on each surface #
The same Unified Audit Log record uses different field names on each surface. A query built for one surface can silently miss on another. These pages document the Management Activity API JSON names, the same names Search-UnifiedAuditLog and the Office 365 Management Activity API return.
- Purview CSV export flattens each record to four columns (
CreationDate,UserIds,Operations,AuditData). The API field names live only inside theAuditDataJSON blob. Expand it withConvertFrom-Json. The wrapper columns are renamed too:CreationDatenotCreationTime,UserIdsnotUserId,OperationsnotOperation. - Sentinel's
OfficeActivitytable renames several fields and turns two integer enum columns into strings. The table below maps them.
| API JSON (event pages) | OfficeActivity column | Note |
|---|---|---|
Id | OfficeId | Renamed. |
Workload | OfficeWorkload | Renamed. |
ObjectId | OfficeObjectId | Renamed. |
CreationTime | TimeGenerated | Renamed. OfficeActivity has no CreationTime column. |
SiteUrl | Site_Url | Renamed (SharePoint family). |
RecordType | RecordType | Same name; the Int32 enum becomes its string enum name. |
UserType | UserType | Same name; the Int32 enum becomes a string. |
ClientIP | ClientIP, Client_IPAddress | Both columns present on OfficeActivity. |
Scope | (none) | No OfficeActivity equivalent under any name. Recover it from the API JSON or the Purview AuditData blob. |
Operation, UserId, ResultStatus, UserKey, AppAccessContext, OrganizationId | same names | Unchanged. No _s / _d suffixes (a native table, not a custom log). |
Mapping verified against the OfficeActivity table reference, the Management Activity API schema, and the Purview audit-record export format.