Power Automate activity
| Operation | Description | Sample | Rule |
|---|---|---|---|
| any | Catch-all for M365-MicrosoftFlow rules matching the RecordType but no specific Operation. | N | Y |
| Created flow | A flow is created. | N | N |
| Create | A Power Automate flow was created. Observed in first-party Unified Audit Log capture as the literal Operation token (RecordType 30, MicrosoftFlow); the Purview activity-logging article documents this same lifecycle event under the human-readable label "Created flow" instead. | Y | Y |
| Deleted flow | A flow is deleted. | N | N |
| Deleted permissions | A user's permissions to a flow are removed. | N | N |
| Delete | A Power Automate flow was deleted. Observed in first-party Unified Audit Log capture as the literal Operation token (RecordType 30, MicrosoftFlow), matching the CreateFlow convention; the Purview activity-logging article documents this same lifecycle event under the human-readable label "Deleted flow" instead. | Y | Y |
| Edited flow | An update is made to a flow. | N | N |
| Edited permissions | A user's permissions to a flow change, for example adding a co-owner. | N | N |
| Microsoft Entra ID joined | A hosted RPA bot is joined to the tenant's Microsoft Entra ID. The doc notes this event is actually surfaced under RecordType PowerPlatformAdministratorActivity. | N | N |
| Renewed a paid trial | A user renews a paid Power Automate trial. | N | N |
| Started a paid trial | A user starts a paid Power Automate trial. | N | N |
any: Power Automate activity (catch-all)
#Description
Catch-all for M365-MicrosoftFlow rules matching the RecordType but no specific Operation.
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Kusto #
T0813, T0826, T0879, T1485, T1491, T1567↳ also matches CreateFlow
Created flow
#Description
A flow is created.
CreateFlow
#Description
A Power Automate flow was created. Observed in first-party Unified Audit Log capture as the literal Operation token (RecordType 30, MicrosoftFlow); the Purview activity-logging article documents this same lifecycle event under the human-readable label "Created flow" instead.
Example Audit Record #
{
"ClientIP": "255.255.255.255",
"CreationTime": "2026-07-04T19:15:59Z",
"FlowDetailsUrl": "https://admin.powerplatform.microsoft.com/environments/Default-00000000-0000-0000-0000-000000000001/flows/8c6ea44d-0c0b-45da-954d-8632713e0a74/flowDetails",
"Id": "bdc542b5-d168-4e63-a2f6-0accf177bc21",
"ObjectId": "11111111-1111-1111-1111-111111111111",
"Operation": "CreateFlow",
"OrganizationId": "00000000-0000-0000-0000-000000000001",
"RecordType": 30,
"ResultStatus": "Success",
"SharingPermission": 1,
"UserId": "adminuser@example.onmicrosoft.com",
"UserKey": "11111111-1111-1111-1111-111111111111",
"UserType": 0,
"UserTypeInitiated": 1,
"UserUPN": "adminuser@example.onmicrosoft.com",
"Version": 1,
"Workload": "MicrosoftFlow"
}
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Kusto #
T0813, T0826, T0879, T1485, T1491, T1567↳ also matches any: Power Automate activity (catch-all)
Deleted flow
#Description
A flow is deleted.
Deleted permissions
#Description
A user's permissions to a flow are removed.
DeleteFlow
#Description
A Power Automate flow was deleted. Observed in first-party Unified Audit Log capture as the literal Operation token (RecordType 30, MicrosoftFlow), matching the CreateFlow convention; the Purview activity-logging article documents this same lifecycle event under the human-readable label "Deleted flow" instead.
Example Audit Record #
{
"ClientIP": "255.255.255.255",
"CreationDate": "2026-07-25T20:08:57",
"CreationTime": "2026-07-25T20:08:57",
"FlowDetailsUrl": "https://admin.powerplatform.microsoft.com/environments/Default-00000000-0000-0000-0000-000000000001/flows/604c862b-7311-4c3e-8b9c-fe18548fd006/flowDetails",
"Id": "a2493c16-f180-4491-a0b6-f83ed03e7435",
"ObjectId": "11111111-1111-1111-1111-111111111111",
"Operation": "DeleteFlow",
"Operations": "DeleteFlow",
"OrganizationId": "00000000-0000-0000-0000-000000000001",
"RecordType": 30,
"ResultStatus": "Success",
"SharingPermission": 1,
"UserId": "adminuser@example.onmicrosoft.com",
"UserKey": "11111111-1111-1111-1111-111111111111",
"UserType": "Regular",
"UserTypeInitiated": 1,
"UserUPN": "adminuser@example.onmicrosoft.com",
"Version": 1,
"Workload": "MicrosoftFlow"
}
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Kusto #
T0828, T1485, T1562
Edited flow
#Description
An update is made to a flow.
Edited permissions
#Description
A user's permissions to a flow change, for example adding a co-owner.
Microsoft Entra ID joined
#Description
A hosted RPA bot is joined to the tenant's Microsoft Entra ID. The doc notes this event is actually surfaced under RecordType PowerPlatformAdministratorActivity.
Renewed a paid trial
#Description
A user renews a paid Power Automate trial.
Started a paid trial
#Description
A user starts a paid Power Automate trial.
References #
M365 audit records use different field names on each surface #
The same Unified Audit Log record uses different field names on each surface. A query built for one surface can silently miss on another. These pages document the Management Activity API JSON names, the same names Search-UnifiedAuditLog and the Office 365 Management Activity API return.
- Purview CSV export flattens each record to four columns (
CreationDate,UserIds,Operations,AuditData). The API field names live only inside theAuditDataJSON blob. Expand it withConvertFrom-Json. The wrapper columns are renamed too:CreationDatenotCreationTime,UserIdsnotUserId,OperationsnotOperation. - Sentinel's
OfficeActivitytable renames several fields and turns two integer enum columns into strings. The table below maps them.
| API JSON (event pages) | OfficeActivity column | Note |
|---|---|---|
Id | OfficeId | Renamed. |
Workload | OfficeWorkload | Renamed. |
ObjectId | OfficeObjectId | Renamed. |
CreationTime | TimeGenerated | Renamed. OfficeActivity has no CreationTime column. |
SiteUrl | Site_Url | Renamed (SharePoint family). |
RecordType | RecordType | Same name; the Int32 enum becomes its string enum name. |
UserType | UserType | Same name; the Int32 enum becomes a string. |
ClientIP | ClientIP, Client_IPAddress | Both columns present on OfficeActivity. |
Scope | (none) | No OfficeActivity equivalent under any name. Recover it from the API JSON or the Purview AuditData blob. |
Operation, UserId, ResultStatus, UserKey, AppAccessContext, OrganizationId | same names | Unchanged. No _s / _d suffixes (a native table, not a custom log). |
Mapping verified against the OfficeActivity table reference, the Management Activity API schema, and the Purview audit-record export format.