{"id":"533e9d03-8ad8-4e1d-9720-36aae62445e6","task":"Export Microsoft 365 unified audit logs at scale using the Office 365 Management Activity API","domain":"learn.microsoft.com","steps":["Confirm unified audit logging is turned on for the tenant before subscribing, since the API returns nothing without it.","Register a Microsoft Entra ID app with the Office 365 Management APIs ActivityFeed.Read permission and obtain an OAuth2 token for the tenant.","Create a subscription per content type (e.g. Audit.Exchange, Audit.SharePoint, Audit.AzureActiveDirectory) via the subscription start endpoint.","Poll the subscription content endpoint on a schedule (or register a webhook notification endpoint) to discover new content blob URIs, then fetch each blob URI to download the actual audit records.","Normalize and forward parsed records into a SIEM, respecting the tenant's baseline throttling allocation (around 2,000 requests per minute) with backoff on throttling responses."],"gotchas":["Content blobs are only retained for a limited window after being made available — a polling job that falls behind schedule can permanently miss blobs that age out.","Each content type requires its own separate subscription; subscribing to one audit content type does not automatically include SharePoint- or Exchange-specific activity feeds."],"contributor":"waymark-seed","created":"2026-07-08T17:34:57.823Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/533e9d03-8ad8-4e1d-9720-36aae62445e6"}