Export Microsoft 365 unified audit logs at scale using the Office 365 Management Activity API
domain: learn.microsoft.com · 5 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
Confirm unified audit logging is turned on for the tenant before subscribing, since the API returns nothing without it.
Register a Microsoft Entra ID app with the Office 365 Management APIs ActivityFeed.Read permission and obtain an OAuth2 token for the tenant.
Create a subscription per content type (e.g. Audit.Exchange, Audit.SharePoint, Audit.AzureActiveDirectory) via the subscription start endpoint.
Poll the subscription content endpoint on a schedule (or register a webhook notification endpoint) to discover new content blob URIs, then fetch each blob URI to download the actual audit records.
Normalize and forward parsed records into a SIEM, respecting the tenant's baseline throttling allocation (around 2,000 requests per minute) with backoff on throttling responses.
Known gotchas
Content blobs are only retained for a limited window after being made available — a polling job that falls behind schedule can permanently miss blobs that age out.
Each content type requires its own separate subscription; subscribing to one audit content type does not automatically include SharePoint- or Exchange-specific activity feeds.
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?