Power Apps activity
| Operation | Description | Sample | Rule |
|---|---|---|---|
| any | Catch-all for M365-PowerAppsApp rules matching the RecordType but no specific Operation. | N | Y |
| Admin allowed third party apps | An admin allows third party apps. | N | N |
| Admin modified app owner | An admin modifies the app owner. | N | N |
| Admin modified app permissions | An admin modifies the app permissions. | N | N |
| Admin restored deleted app | An admin restores a deleted app. | N | N |
| Admin set app as featured | An admin marks the app as Featured. | N | N |
| Admin set bypass consent state | An admin sets the bypass consent state of the app. | N | N |
| Admin set conditional access | An admin sets the conditional access policy of the app. | N | N |
| Admin set desired logical name | An admin sets the desired logical name of the app. | N | N |
| Admin set quarantine state | An admin sets the quarantine state of the app. | N | N |
| Admin | An admin deletes the app. Token confirmed via the doc's example activity JSON (powerplatform.analytics.activity.name). | N | Y |
| Consented to the app's APIs | The current user consents to the application's APIs. | N | N |
| Created app | A maker creates the app for the first time. | N | N |
| Data | A data loss prevention policy evaluation occurs for the app. | N | N |
| Deleted app | The app is deleted. | N | N |
| Deleted app permission | A user's permissions to the app are removed. | N | N |
| Deleted app version | A version of the app is deleted. | N | N |
| Edited app | The maker updates the app. | N | N |
| Edited app permission | A user's permissions to the app change. | N | N |
| Imported existing canvas app | An existing canvas app is imported. | N | N |
| Imported new canvas app | A new canvas app is imported. | N | N |
| Launched app | The app is launched. | N | N |
| Marked app as Featured | The app is marked as Featured. | N | N |
| Marked app as Hero | The app is marked as Hero. | N | N |
| Patched app | The app is patched. | N | N |
| Published app | The app is published and made available to others in the environment. | N | N |
| Published solution canvas app version | A canvas app version from a solution is published. | N | N |
| Removed app as Featured | The app is unset as Featured. | N | N |
| Removed app as Hero | The app is unset as Hero. | N | N |
| Restored app version | A prior version of the app is restored. | N | N |
any: Power Apps activity (catch-all)
#Description
Catch-all for M365-PowerAppsApp rules matching the RecordType but no specific Operation.
Common Indicators #
Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.
| Field | Kind | Value | Rules | Vendors |
|---|---|---|---|---|
Type (kusto rule field) | eq | url | 1 rule | kusto |
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Kusto #
T1078↳ also matches AdminDeleteApp T1189, T1566
Admin allowed third party apps
#Description
An admin allows third party apps.
Admin modified app owner
#Description
An admin modifies the app owner.
Admin modified app permissions
#Description
An admin modifies the app permissions.
Admin restored deleted app
#Description
An admin restores a deleted app.
Admin set app as featured
#Description
An admin marks the app as Featured.
Admin set bypass consent state
#Description
An admin sets the bypass consent state of the app.
Admin set conditional access
#Description
An admin sets the conditional access policy of the app.
Admin set desired logical name
#Description
An admin sets the desired logical name of the app.
Admin set quarantine state
#Description
An admin sets the quarantine state of the app.
AdminDeleteApp
#Description
An admin deletes the app. Token confirmed via the doc's example activity JSON (powerplatform.analytics.activity.name).
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Kusto #
T1078↳ also matches any: Power Apps activity (catch-all)
Consented to the app's APIs
#Description
The current user consents to the application's APIs.
Created app
#Description
A maker creates the app for the first time.
DataLossPreventionEvaluationResult
#Description
A data loss prevention policy evaluation occurs for the app.
Deleted app
#Description
The app is deleted.
Deleted app permission
#Description
A user's permissions to the app are removed.
Deleted app version
#Description
A version of the app is deleted.
Edited app
#Description
The maker updates the app.
Edited app permission
#Description
A user's permissions to the app change.
Imported existing canvas app
#Description
An existing canvas app is imported.
Imported new canvas app
#Description
A new canvas app is imported.
Launched app
#Description
The app is launched.
Marked app as Featured
#Description
The app is marked as Featured.
Marked app as Hero
#Description
The app is marked as Hero.
Patched app
#Description
The app is patched.
Published app
#Description
The app is published and made available to others in the environment.
Published solution canvas app version
#Description
A canvas app version from a solution is published.
Removed app as Featured
#Description
The app is unset as Featured.
Removed app as Hero
#Description
The app is unset as Hero.
Restored app version
#Description
A prior version of the app is restored.
References #
M365 audit records use different field names on each surface #
The same Unified Audit Log record uses different field names on each surface. A query built for one surface can silently miss on another. These pages document the Management Activity API JSON names, the same names Search-UnifiedAuditLog and the Office 365 Management Activity API return.
- Purview CSV export flattens each record to four columns (
CreationDate,UserIds,Operations,AuditData). The API field names live only inside theAuditDataJSON blob. Expand it withConvertFrom-Json. The wrapper columns are renamed too:CreationDatenotCreationTime,UserIdsnotUserId,OperationsnotOperation. - Sentinel's
OfficeActivitytable renames several fields and turns two integer enum columns into strings. The table below maps them.
| API JSON (event pages) | OfficeActivity column | Note |
|---|---|---|
Id | OfficeId | Renamed. |
Workload | OfficeWorkload | Renamed. |
ObjectId | OfficeObjectId | Renamed. |
CreationTime | TimeGenerated | Renamed. OfficeActivity has no CreationTime column. |
SiteUrl | Site_Url | Renamed (SharePoint family). |
RecordType | RecordType | Same name; the Int32 enum becomes its string enum name. |
UserType | UserType | Same name; the Int32 enum becomes a string. |
ClientIP | ClientIP, Client_IPAddress | Both columns present on OfficeActivity. |
Scope | (none) | No OfficeActivity equivalent under any name. Recover it from the API JSON or the Purview AuditData blob. |
Operation, UserId, ResultStatus, UserKey, AppAccessContext, OrganizationId | same names | Unchanged. No _s / _d suffixes (a native table, not a custom log). |
Mapping verified against the OfficeActivity table reference, the Management Activity API schema, and the Purview audit-record export format.