Microsoft Purview data lifecycle activity

Operation	Description	Sample	Rule
any	Catch-all for M365-DataGovernance rules matching the RecordType but no specific Operation.	N	N
NewComplianceTag	New Compliance Tag activity in Microsoft Purview data lifecycle, recorded in the Unified Audit Log (observed in first-party capture).	Y	N
NewRetentionCompliancePolicy	New Retention Compliance Policy activity in Microsoft Purview data lifecycle, recorded in the Unified Audit Log (observed in first-party capture).	Y	N
NewRetentionComplianceRule	New Retention Compliance Rule activity in Microsoft Purview data lifecycle, recorded in the Unified Audit Log (observed in first-party capture).	Y	N
RemoveComplianceTag	Remove Compliance Tag activity in Microsoft Purview data lifecycle, recorded in the Unified Audit Log (observed in first-party capture).	Y	N
RemoveRetentionCompliancePolicy	Remove Retention Compliance Policy activity in Microsoft Purview data lifecycle, recorded in the Unified Audit Log (observed in first-party capture).	Y	N
SetComplianceTag	Set Compliance Tag activity in Microsoft Purview data lifecycle, recorded in the Unified Audit Log (observed in first-party capture).	Y	N

any: Microsoft Purview data lifecycle activity (catch-all)

RecordType: DataGovernance

Description

Catch-all for M365-DataGovernance rules matching the RecordType but no specific Operation.

NewComplianceTag

RecordType: DataGovernance

Description

New Compliance Tag activity in Microsoft Purview data lifecycle, recorded in the Unified Audit Log (observed in first-party capture).

Example Audit Record #

{
  "CreationDate": "2026-07-03T05:28:44",
  "CreationTime": "2026-07-03T05:28:44",
  "ExtendedProperties": [
    {
      "Name": "RetentionAction",
      "Value": "Keep"
    },
    {
      "Name": "RetentionDuration",
      "Value": "Unlimited"
    },
    {
      "Name": "RetentionType",
      "Value": "TaggedAgeInDays"
    },
    {
      "Name": "Workload",
      "Value": "Exchange, SharePoint, OneDriveForBusiness"
    },
    {
      "Name": "IsRecord",
      "Value": "False"
    },
    {
      "Name": "Regulatory",
      "Value": "False"
    },
    {
      "Name": "CreatedBy",
      "Value": "Admin User"
    },
    {
      "Name": "CreatedDateUTC",
      "Value": "7/3/2026 5:28:44 AM"
    },
    {
      "Name": "LastModifiedDateUTC",
      "Value": "7/3/2026 5:28:44 AM"
    },
    {
      "Name": "ModifiedBy",
      "Value": "Admin User"
    },
    {
      "Name": "Description",
      "Value": "harness"
    },
    {
      "Name": "LabelName",
      "Value": "dw-deleg-rl"
    },
    {
      "Name": "IsPriorityCleanup",
      "Value": "False"
    }
  ],
  "Id": "5bdc8e5e-3ca1-49a0-8b04-08ded8c3f384",
  "ObjectType": "ComplianceTag",
  "Operation": "NewComplianceTag",
  "Operations": "NewComplianceTag",
  "OrganizationId": "11111111-1111-1111-1111-111111111111",
  "Parameters": [
    {
      "Name": "CmdletOptions",
      "Value": "-Name \"dw-deleg-rl\" -Organization \"11111111-1111-1111-1111-111111111111\" -RetentionAction \"Keep\" -RetentionDuration \"Unlimited\" -RetentionType \"TaggedAgeInDays\" -Comment \"harness\""
    },
    {
      "Name": "Cmdlet",
      "Value": ""
    }
  ],
  "RecordType": "DataGovernance",
  "UserId": "adminuser@example.onmicrosoft.com",
  "UserKey": "aaaaaaaa-0000-0000-0000-000000000001",
  "UserType": "Regular",
  "Version": 1,
  "Workload": "SecurityComplianceCenter"
}

NewRetentionCompliancePolicy

RecordType: DataGovernance

Description

New Retention Compliance Policy activity in Microsoft Purview data lifecycle, recorded in the Unified Audit Log (observed in first-party capture).

Example Audit Record #

{
  "CreationDate": "2026-07-03T05:55:56",
  "CreationTime": "2026-07-03T05:55:56",
  "ExtendedProperties": [
    {
      "Name": "Workload",
      "Value": "Exchange, SharePoint, OneDriveForBusiness, Skype, ModernGroup, DynamicScope"
    },
    {
      "Name": "CreatedBy",
      "Value": ""
    },
    {
      "Name": "CreatedDateUTC",
      "Value": "7/3/2026 5:55:55 AM"
    },
    {
      "Name": "LastModifiedDateUTC",
      "Value": "7/3/2026 5:55:55 AM"
    },
    {
      "Name": "ModifiedBy",
      "Value": ""
    },
    {
      "Name": "ExchangeLocation",
      "Value": "All"
    },
    {
      "Name": "ExchangeLocationException",
      "Value": ""
    },
    {
      "Name": "SkypeLocation",
      "Value": ""
    },
    {
      "Name": "SkypeLocationException",
      "Value": ""
    },
    {
      "Name": "ModernGroupLocation",
      "Value": ""
    },
    {
      "Name": "ModernGroupLocationException",
      "Value": ""
    },
    {
      "Name": "OneDriveLocation",
      "Value": ""
    },
    {
      "Name": "OneDriveLocationException",
      "Value": ""
    },
    {
      "Name": "PublicFolderLocation",
      "Value": ""
    },
    {
      "Name": "SharePointLocation",
      "Value": ""
    },
    {
      "Name": "SharePointLocationException",
      "Value": ""
    },
    {
      "Name": "AdaptiveScopeLocation",
      "Value": ""
    },
    {
      "Name": "IsPreservationLock",
      "Value": "False"
    },
    {
      "Name": "TeamsChatLocation",
      "Value": ""
    },
    {
      "Name": "TeamsChatLocationException",
      "Value": ""
    },
    {
      "Name": "TeamsChannelLocation",
      "Value": ""
    },
    {
      "Name": "TeamsChannelLocationException",
      "Value": ""
    },
    {
      "Name": "IsTeamsPolicy",
      "Value": "False"
    },
    {
      "Name": "IsPriorityCleanup",
      "Value": "False"
    },
    {
      "Name": "Applications",
      "Value": "System.String[]"
    }
  ],
  "Id": "05606618-280c-454d-a342-08ded8c7bfc4",
  "ObjectType": "CompliancePolicy",
  "Operation": "NewRetentionCompliancePolicy",
  "Operations": "NewRetentionCompliancePolicy",
  "OrganizationId": "11111111-1111-1111-1111-111111111111",
  "Parameters": [
    {
      "Name": "CmdletOptions",
      "Value": "-ExchangeLocation (\"All\") -Name \"dwharn9babc3-ret\""
    },
    {
      "Name": "Cmdlet",
      "Value": ""
    }
  ],
  "RecordType": "DataGovernance",
  "UserId": "OAuthUser@11111111-1111-1111-1111-111111111111",
  "UserKey": "22222222-2222-2222-2222-222222222222",
  "UserType": "Regular",
  "Version": 1,
  "Workload": "SecurityComplianceCenter"
}

NewRetentionComplianceRule

RecordType: DataGovernance

Description

New Retention Compliance Rule activity in Microsoft Purview data lifecycle, recorded in the Unified Audit Log (observed in first-party capture).

Example Audit Record #

{
  "CreationDate": "2026-07-03T05:59:56",
  "CreationTime": "2026-07-03T05:59:56",
  "ExtendedProperties": [
    {
      "Name": "PolicyName",
      "Value": "dwharnee8749b4-ret"
    },
    {
      "Name": "Workload",
      "Value": "Exchange, SharePoint, OneDriveForBusiness, Skype, ModernGroup, DynamicScope"
    },
    {
      "Name": "CreatedBy",
      "Value": ""
    },
    {
      "Name": "CreatedDateUTC",
      "Value": "7/3/2026 5:59:55 AM"
    },
    {
      "Name": "LastModifiedDateUTC",
      "Value": "7/3/2026 5:59:55 AM"
    },
    {
      "Name": "ModifiedBy",
      "Value": ""
    },
    {
      "Name": "RetentionAction",
      "Value": "Keep"
    },
    {
      "Name": "RetentionDuration",
      "Value": "365"
    },
    {
      "Name": "RetentionType",
      "Value": "Days"
    },
    {
      "Name": "IsPriorityCleanup",
      "Value": "False"
    }
  ],
  "Id": "bd56bdcc-beb2-434a-3780-08ded8c84ee7",
  "ObjectType": "ComplianceRule",
  "Operation": "NewRetentionComplianceRule",
  "Operations": "NewRetentionComplianceRule",
  "OrganizationId": "11111111-1111-1111-1111-111111111111",
  "Parameters": [
    {
      "Name": "CmdletOptions",
      "Value": "-RetentionComplianceAction \"Keep\" -Name \"dwharnee8749b4-retr\" -RetentionDuration \"365\" -Policy \"dwharnee8749b4-ret\""
    },
    {
      "Name": "Cmdlet",
      "Value": ""
    }
  ],
  "RecordType": "DataGovernance",
  "UserId": "OAuthUser@11111111-1111-1111-1111-111111111111",
  "UserKey": "22222222-2222-2222-2222-222222222222",
  "UserType": "Regular",
  "Version": 1,
  "Workload": "SecurityComplianceCenter"
}

RemoveComplianceTag

RecordType: DataGovernance

Description

Remove Compliance Tag activity in Microsoft Purview data lifecycle, recorded in the Unified Audit Log (observed in first-party capture).

Example Audit Record #

{
  "CreationDate": "2026-07-03T05:28:55",
  "CreationTime": "2026-07-03T05:28:55",
  "ExtendedProperties": [
    {
      "Name": "RetentionAction",
      "Value": "Keep"
    },
    {
      "Name": "RetentionDuration",
      "Value": "Unlimited"
    },
    {
      "Name": "RetentionType",
      "Value": "TaggedAgeInDays"
    },
    {
      "Name": "Workload",
      "Value": "Exchange, SharePoint, OneDriveForBusiness"
    },
    {
      "Name": "IsRecord",
      "Value": "False"
    },
    {
      "Name": "Regulatory",
      "Value": "False"
    },
    {
      "Name": "CreatedBy",
      "Value": "Admin User"
    },
    {
      "Name": "CreatedDateUTC",
      "Value": "7/3/2026 5:28:44 AM"
    },
    {
      "Name": "LastModifiedDateUTC",
      "Value": "7/3/2026 5:28:44 AM"
    },
    {
      "Name": "ModifiedBy",
      "Value": "Admin User"
    },
    {
      "Name": "Description",
      "Value": "harness"
    },
    {
      "Name": "LabelName",
      "Value": "dw-deleg-rl"
    },
    {
      "Name": "IsPriorityCleanup",
      "Value": "False"
    }
  ],
  "Id": "75d498bf-6fa0-4949-91a8-08ded8c3fa13",
  "ObjectType": "ComplianceTag",
  "Operation": "RemoveComplianceTag",
  "Operations": "RemoveComplianceTag",
  "OrganizationId": "11111111-1111-1111-1111-111111111111",
  "Parameters": [
    {
      "Name": "CmdletOptions",
      "Value": "-Identity \"f14669c8-8fc0-4d84-b1dd-14909e1ff33c\""
    },
    {
      "Name": "Cmdlet",
      "Value": ""
    }
  ],
  "RecordType": "DataGovernance",
  "UserId": "adminuser@example.onmicrosoft.com",
  "UserKey": "aaaaaaaa-0000-0000-0000-000000000001",
  "UserType": "Regular",
  "Version": 1,
  "Workload": "SecurityComplianceCenter"
}

RemoveRetentionCompliancePolicy

RecordType: DataGovernance

Description

Remove Retention Compliance Policy activity in Microsoft Purview data lifecycle, recorded in the Unified Audit Log (observed in first-party capture).

Example Audit Record #

{
  "CreationDate": "2026-07-03T06:02:39",
  "CreationTime": "2026-07-03T06:02:39",
  "ExtendedProperties": [
    {
      "Name": "Workload",
      "Value": "Exchange, SharePoint, OneDriveForBusiness, Skype, ModernGroup, DynamicScope"
    },
    {
      "Name": "CreatedBy",
      "Value": ""
    },
    {
      "Name": "CreatedDateUTC",
      "Value": "7/3/2026 5:59:52 AM"
    },
    {
      "Name": "LastModifiedDateUTC",
      "Value": "7/3/2026 5:59:56 AM"
    },
    {
      "Name": "ModifiedBy",
      "Value": ""
    },
    {
      "Name": "ExchangeLocation",
      "Value": "All"
    },
    {
      "Name": "ExchangeLocationException",
      "Value": ""
    },
    {
      "Name": "SkypeLocation",
      "Value": ""
    },
    {
      "Name": "SkypeLocationException",
      "Value": ""
    },
    {
      "Name": "ModernGroupLocation",
      "Value": ""
    },
    {
      "Name": "ModernGroupLocationException",
      "Value": ""
    },
    {
      "Name": "OneDriveLocation",
      "Value": ""
    },
    {
      "Name": "OneDriveLocationException",
      "Value": ""
    },
    {
      "Name": "PublicFolderLocation",
      "Value": ""
    },
    {
      "Name": "SharePointLocation",
      "Value": ""
    },
    {
      "Name": "SharePointLocationException",
      "Value": ""
    },
    {
      "Name": "AdaptiveScopeLocation",
      "Value": ""
    },
    {
      "Name": "IsPreservationLock",
      "Value": "False"
    },
    {
      "Name": "TeamsChatLocation",
      "Value": ""
    },
    {
      "Name": "TeamsChatLocationException",
      "Value": ""
    },
    {
      "Name": "TeamsChannelLocation",
      "Value": ""
    },
    {
      "Name": "TeamsChannelLocationException",
      "Value": ""
    },
    {
      "Name": "IsTeamsPolicy",
      "Value": "False"
    },
    {
      "Name": "IsPriorityCleanup",
      "Value": "False"
    },
    {
      "Name": "Applications",
      "Value": "System.String[]"
    }
  ],
  "Id": "3d3c89cc-a073-419a-d867-08ded8c8b072",
  "ObjectType": "CompliancePolicy",
  "Operation": "RemoveRetentionCompliancePolicy",
  "Operations": "RemoveRetentionCompliancePolicy",
  "OrganizationId": "11111111-1111-1111-1111-111111111111",
  "Parameters": [
    {
      "Name": "CmdletOptions",
      "Value": "-ErrorAction \"Stop\" -Identity \"dwharnee8749b4-ret\" -Confirm \"False\""
    },
    {
      "Name": "Cmdlet",
      "Value": ""
    }
  ],
  "RecordType": "DataGovernance",
  "UserId": "OAuthUser@11111111-1111-1111-1111-111111111111",
  "UserKey": "22222222-2222-2222-2222-222222222222",
  "UserType": "Regular",
  "Version": 1,
  "Workload": "SecurityComplianceCenter"
}

SetComplianceTag

RecordType: DataGovernance

Description

Set Compliance Tag activity in Microsoft Purview data lifecycle, recorded in the Unified Audit Log (observed in first-party capture).

Example Audit Record #

{
  "CreationDate": "2026-07-03T05:30:06",
  "CreationTime": "2026-07-03T05:30:06",
  "ExtendedProperties": [
    {
      "Name": "RetentionAction",
      "Value": "Keep"
    },
    {
      "Name": "RetentionDuration",
      "Value": "Unlimited"
    },
    {
      "Name": "RetentionType",
      "Value": "TaggedAgeInDays"
    },
    {
      "Name": "Workload",
      "Value": "Exchange, SharePoint, OneDriveForBusiness"
    },
    {
      "Name": "IsRecord",
      "Value": "False"
    },
    {
      "Name": "Regulatory",
      "Value": "False"
    },
    {
      "Name": "CreatedBy",
      "Value": "Admin User"
    },
    {
      "Name": "CreatedDateUTC",
      "Value": "7/3/2026 5:29:59 AM"
    },
    {
      "Name": "LastModifiedDateUTC",
      "Value": "7/3/2026 5:29:59 AM"
    },
    {
      "Name": "ModifiedBy",
      "Value": "Admin User"
    },
    {
      "Name": "Description",
      "Value": "updated"
    },
    {
      "Name": "LabelName",
      "Value": "dw-harness-rl-7ec88469"
    },
    {
      "Name": "IsPriorityCleanup",
      "Value": "False"
    }
  ],
  "Id": "c175cda1-323c-406e-80f2-08ded8c42428",
  "ObjectType": "ComplianceTag",
  "Operation": "SetComplianceTag",
  "Operations": "SetComplianceTag",
  "OrganizationId": "11111111-1111-1111-1111-111111111111",
  "Parameters": [
    {
      "Name": "CmdletOptions",
      "Value": "-Identity \"6abe80c5-29ea-4b98-83bc-cdab2fb733c7\" -Comment \"updated\""
    },
    {
      "Name": "Cmdlet",
      "Value": ""
    }
  ],
  "RecordType": "DataGovernance",
  "UserId": "adminuser@example.onmicrosoft.com",
  "UserKey": "aaaaaaaa-0000-0000-0000-000000000001",
  "UserType": "Regular",
  "Version": 1,
  "Workload": "SecurityComplianceCenter"
}

References #

M365 audit records use different field names on each surface #

The same Unified Audit Log record uses different field names on each surface. A query built for one surface can silently miss on another. These pages document the Management Activity API JSON names, the same names Search-UnifiedAuditLog and the Office 365 Management Activity API return.

Purview CSV export flattens each record to four columns (CreationDate, UserIds, Operations, AuditData). The API field names live only inside the AuditData JSON blob. Expand it with ConvertFrom-Json. The wrapper columns are renamed too: CreationDate not CreationTime, UserIds not UserId, Operations not Operation.
Sentinel's OfficeActivity table renames several fields and turns two integer enum columns into strings. The table below maps them.

API JSON (event pages)	OfficeActivity column	Note
`Id`	`OfficeId`	Renamed.
`Workload`	`OfficeWorkload`	Renamed.
`ObjectId`	`OfficeObjectId`	Renamed.
`CreationTime`	`TimeGenerated`	Renamed. OfficeActivity has no `CreationTime` column.
`SiteUrl`	`Site_Url`	Renamed (SharePoint family).
`RecordType`	`RecordType`	Same name; the Int32 enum becomes its string enum name.
`UserType`	`UserType`	Same name; the Int32 enum becomes a string.
`ClientIP`	`ClientIP`, `Client_IPAddress`	Both columns present on OfficeActivity.
`Scope`	(none)	No OfficeActivity equivalent under any name. Recover it from the API JSON or the Purview `AuditData` blob.
`Operation`, `UserId`, `ResultStatus`, `UserKey`, `AppAccessContext`, `OrganizationId`	same names	Unchanged. No `_s` / `_d` suffixes (a native table, not a custom log).

Mapping verified against the OfficeActivity table reference, the Management Activity API schema, and the Purview audit-record export format.