Power Pages site activity
| Operation | Description | Sample | Rule |
|---|---|---|---|
| any | Catch-all for M365-PowerPagesSite rules matching the RecordType but no specific Operation. | N | N |
| Anonymous | The anonymous access governance control exception list is changed. | N | N |
| Bootstrap | The site's bootstrap version is updated. | N | N |
| CDNDisabled | The CDN is disabled for the site. | N | N |
| CDNEnabled | The CDN is enabled for the site. | N | N |
| Converted | A site is converted from trial to production. | N | N |
| Custom | A custom certificate associated with the site is updated. | N | N |
| Custom | A site is connected to a custom domain. | N | N |
| Custom | A custom domain is removed from the site. | N | N |
| Custom | Custom errors are disabled for the site. | N | N |
| Custom | Custom errors are enabled for the site. | N | N |
| D365 | The Dynamics 365 URL for the site is updated. | N | N |
| Data | The site's data model version is updated. | N | N |
| Diagnostic | Diagnostic logs are disabled for the site. | N | N |
| Diagnostic | Diagnostic logs are enabled for the site. | N | N |
| Early | Early upgrade is disabled for the site. | N | N |
| Early | Early upgrade is enabled for the site. | N | N |
| Field | The field service extension is installed on the site. | N | N |
| IPRestrictions | A new range of IP addresses is added that can access the site. | N | N |
| IPRestrictions | A range of IP addresses that could access the site is deleted. | N | N |
| Maintenance | A site is taken off maintenance mode. | N | N |
| Maintenance | A site is put into maintenance mode. | N | N |
| Maintenance | The maintenance mode URL is modified. | N | N |
| Power | Power BI embedded service is disabled for the site. | N | N |
| Power | Power BI embedded service is enabled for the site. | N | N |
| Power | Power BI visualization is disabled for the site. | N | N |
| Power | Power BI visualization is enabled for the site. | N | N |
| Project | The project service automation extension is installed on the site. | N | N |
| Share | SharePoint integration is disabled for the site. | N | N |
| Share | SharePoint integration is enabled for the site. | N | N |
| Site | The site is archived. | N | N |
| Site | The site is created. | N | N |
| Site | A site is deleted. | N | N |
| Site | A site name is changed. | N | N |
| Site | A site is restarted. | N | N |
| Site | A site is shut down. | N | N |
| Site | The site is suspended. | N | N |
| Site | The site is unarchived. | N | N |
| Site | A site URL is changed. | N | N |
| Site | Site visibility permissions, meaning who can change site visibility, are updated. | N | N |
| Site | Site visibility is changed, from private to public or public to private. | N | N |
| WAFDisabled | Azure Front Door Web Application Firewall protection is disabled for the site. | N | N |
| WAFEnabled | Azure Front Door Web Application Firewall protection is enabled for the site. | N | N |
| Website | The website authentication key is updated. | N | N |
| Website | A website record is updated. | N | N |
any: Power Pages site activity (catch-all)
#Description
Catch-all for M365-PowerPagesSite rules matching the RecordType but no specific Operation.
AnonymousSettingExceptionListChanged
#Description
The anonymous access governance control exception list is changed.
BootstrapVersionUpdated
#Description
The site's bootstrap version is updated.
CDNDisabled
#Description
The CDN is disabled for the site.
CDNEnabled
#Description
The CDN is enabled for the site.
ConvertedToProduction
#Description
A site is converted from trial to production.
CustomCertificateUpdated
#Description
A custom certificate associated with the site is updated.
CustomDomainConnected
#Description
A site is connected to a custom domain.
CustomDomainDeleted
#Description
A custom domain is removed from the site.
CustomErrorsDisabled
#Description
Custom errors are disabled for the site.
CustomErrorsEnabled
#Description
Custom errors are enabled for the site.
D365URLUpdated
#Description
The Dynamics 365 URL for the site is updated.
DataModelVersionUpdated
#Description
The site's data model version is updated.
DiagnosticLogsDisabled
#Description
Diagnostic logs are disabled for the site.
DiagnosticLogsEnabled
#Description
Diagnostic logs are enabled for the site.
EarlyUpgradeDisabled
#Description
Early upgrade is disabled for the site.
EarlyUpgradeEnabled
#Description
Early upgrade is enabled for the site.
FieldServiceExtensionInstalled
#Description
The field service extension is installed on the site.
IPRestrictionsAdded
#Description
A new range of IP addresses is added that can access the site.
IPRestrictionsDeleted
#Description
A range of IP addresses that could access the site is deleted.
MaintenanceModeDisabled
#Description
A site is taken off maintenance mode.
MaintenanceModeEnabled
#Description
A site is put into maintenance mode.
MaintenanceModeURLModified
#Description
The maintenance mode URL is modified.
PowerBIEmbeddedServiceDisabled
#Description
Power BI embedded service is disabled for the site.
PowerBIEmbeddedServiceEnabled
#Description
Power BI embedded service is enabled for the site.
PowerBIVisualizationDisabled
#Description
Power BI visualization is disabled for the site.
PowerBIVisualizationEnabled
#Description
Power BI visualization is enabled for the site.
ProjectServiceAutomationExtensionInstalled
#Description
The project service automation extension is installed on the site.
SiteArchived
#Description
The site is archived.
SiteCreated
#Description
The site is created.
SiteDeleted
#Description
A site is deleted.
SiteNameUpdated
#Description
A site name is changed.
SiteRestarted
#Description
A site is restarted.
SiteShutDown
#Description
A site is shut down.
SiteSuspended
#Description
The site is suspended.
SiteUnarchived
#Description
The site is unarchived.
SiteURLUpdated
#Description
A site URL is changed.
SiteVisibilityPermissionsUpdated
#Description
Site visibility permissions, meaning who can change site visibility, are updated.
SiteVisibilityUpdated
#Description
Site visibility is changed, from private to public or public to private.
WAFDisabled
#Description
Azure Front Door Web Application Firewall protection is disabled for the site.
WAFEnabled
#Description
Azure Front Door Web Application Firewall protection is enabled for the site.
WebsiteAuthenticationKeyUpdated
#Description
The website authentication key is updated.
WebsiteRecordUpdated
#Description
A website record is updated.
References #
M365 audit records use different field names on each surface #
The same Unified Audit Log record uses different field names on each surface. A query built for one surface can silently miss on another. These pages document the Management Activity API JSON names, the same names Search-UnifiedAuditLog and the Office 365 Management Activity API return.
- Purview CSV export flattens each record to four columns (
CreationDate,UserIds,Operations,AuditData). The API field names live only inside theAuditDataJSON blob. Expand it withConvertFrom-Json. The wrapper columns are renamed too:CreationDatenotCreationTime,UserIdsnotUserId,OperationsnotOperation. - Sentinel's
OfficeActivitytable renames several fields and turns two integer enum columns into strings. The table below maps them.
| API JSON (event pages) | OfficeActivity column | Note |
|---|---|---|
Id | OfficeId | Renamed. |
Workload | OfficeWorkload | Renamed. |
ObjectId | OfficeObjectId | Renamed. |
CreationTime | TimeGenerated | Renamed. OfficeActivity has no CreationTime column. |
SiteUrl | Site_Url | Renamed (SharePoint family). |
RecordType | RecordType | Same name; the Int32 enum becomes its string enum name. |
UserType | UserType | Same name; the Int32 enum becomes a string. |
ClientIP | ClientIP, Client_IPAddress | Both columns present on OfficeActivity. |
Scope | (none) | No OfficeActivity equivalent under any name. Recover it from the API JSON or the Purview AuditData blob. |
Operation, UserId, ResultStatus, UserKey, AppAccessContext, OrganizationId | same names | Unchanged. No _s / _d suffixes (a native table, not a custom log). |
Mapping verified against the OfficeActivity table reference, the Management Activity API schema, and the Purview audit-record export format.