Power Platform connectors activity
| Operation | Description | Sample | Rule |
|---|---|---|---|
| any | Catch-all for M365-PowerAppsResource rules matching the RecordType but no specific Operation. | N | N |
| API created | A custom API is created. | N | N |
| API deleted | A custom API is deleted. | N | N |
| API edited | A custom API is updated. | N | N |
| API made solution-aware | A non-solution API is moved into a solution. | N | N |
| API permission added or edited | A custom API is shared, or its sharing permissions are updated. | N | N |
| API permission removed | Sharing permissions of a custom API are removed. | N | N |
| Connection created or edited | A connection is created or updated. | N | N |
| Connection deleted | A connection is deleted. | N | N |
| Connection edited | A connection is updated. | N | N |
| Connection permission added or edited | A connection is shared, or its sharing permissions are updated. | N | N |
| Connection permission removed | Sharing permissions of a connection are removed. | N | N |
| Connection | A connection is turned off because of a data loss prevention policy evaluation. | N | N |
| Gateway cluster edited | A gateway cluster is updated. | N | N |
| Gateway permission added or edited | A gateway is shared, or its sharing permissions are updated. | N | N |
| Gateway permission removed | Sharing permissions of a gateway are removed. | N | N |
any: Power Platform connectors activity (catch-all)
#Description
Catch-all for M365-PowerAppsResource rules matching the RecordType but no specific Operation.
API created
#Description
A custom API is created.
API deleted
#Description
A custom API is deleted.
API edited
#Description
A custom API is updated.
API made solution-aware
#Description
A non-solution API is moved into a solution.
API permission added or edited
#Description
A custom API is shared, or its sharing permissions are updated.
API permission removed
#Description
Sharing permissions of a custom API are removed.
Connection created or edited
#Description
A connection is created or updated.
Connection deleted
#Description
A connection is deleted.
Connection edited
#Description
A connection is updated.
Connection permission added or edited
#Description
A connection is shared, or its sharing permissions are updated.
Connection permission removed
#Description
Sharing permissions of a connection are removed.
ConnectionDlpEvaluationResult
#Description
A connection is turned off because of a data loss prevention policy evaluation.
Gateway cluster edited
#Description
A gateway cluster is updated.
Gateway permission added or edited
#Description
A gateway is shared, or its sharing permissions are updated.
Gateway permission removed
#Description
Sharing permissions of a gateway are removed.
References #
M365 audit records use different field names on each surface #
The same Unified Audit Log record uses different field names on each surface. A query built for one surface can silently miss on another. These pages document the Management Activity API JSON names, the same names Search-UnifiedAuditLog and the Office 365 Management Activity API return.
- Purview CSV export flattens each record to four columns (
CreationDate,UserIds,Operations,AuditData). The API field names live only inside theAuditDataJSON blob. Expand it withConvertFrom-Json. The wrapper columns are renamed too:CreationDatenotCreationTime,UserIdsnotUserId,OperationsnotOperation. - Sentinel's
OfficeActivitytable renames several fields and turns two integer enum columns into strings. The table below maps them.
| API JSON (event pages) | OfficeActivity column | Note |
|---|---|---|
Id | OfficeId | Renamed. |
Workload | OfficeWorkload | Renamed. |
ObjectId | OfficeObjectId | Renamed. |
CreationTime | TimeGenerated | Renamed. OfficeActivity has no CreationTime column. |
SiteUrl | Site_Url | Renamed (SharePoint family). |
RecordType | RecordType | Same name; the Int32 enum becomes its string enum name. |
UserType | UserType | Same name; the Int32 enum becomes a string. |
ClientIP | ClientIP, Client_IPAddress | Both columns present on OfficeActivity. |
Scope | (none) | No OfficeActivity equivalent under any name. Recover it from the API JSON or the Purview AuditData blob. |
Operation, UserId, ResultStatus, UserKey, AppAccessContext, OrganizationId | same names | Unchanged. No _s / _d suffixes (a native table, not a custom log). |
Mapping verified against the OfficeActivity table reference, the Management Activity API schema, and the Purview audit-record export format.