Power Platform DLP activity (legacy)

Operation	Description	Sample	Rule
any	Catch-all for M365-PowerPlatformAdminDlp rules matching the RecordType but no specific Operation.	N	N
Create connector blocking policy	A new connector blocking policy is created.	N	N
Create Connector Configurations	A connector configuration is created for a data policy.	N	N
Create Custom Connector Patterns	A new custom connector URL pattern is created for a data policy.	N	N
Create Data Policy	A new data loss prevention (DLP) policy is created.	N	N
Create Exempt Resources (Deprecated)	An exempt resources list is created for a data policy. Marked deprecated in the source doc.	N	N
Delete connector blocking policy	A connector blocking policy is deleted.	N	N
Delete Connector Configurations	A connector configuration is deleted from a data policy.	N	N
Delete Custom Connector Patterns	A custom connector URL pattern is deleted from a data policy.	N	N
Delete Data Policy	A data loss prevention (DLP) policy is deleted.	N	N
Delete Exempt Resources (Deprecated)	An exempt resources list is deleted from a data policy. Marked deprecated in the source doc.	N	N
Update connector blocking policy	A connector blocking policy is updated.	N	N
Update Connector Configurations	A connector configuration is updated for a data policy.	N	N
Update Custom Connector Patterns	A custom connector URL pattern is updated for a data policy.	N	N
Update Data Policy	A data loss prevention (DLP) policy is updated.	N	N
Update Exempt Resources (Deprecated)	An exempt resources list is updated for a data policy. Marked deprecated in the source doc.	N	N

any: Power Platform DLP activity (legacy) (catch-all)

RecordType: PowerPlatformAdminDlp

Description

Catch-all for M365-PowerPlatformAdminDlp rules matching the RecordType but no specific Operation.

Create connector blocking policy

RecordType: PowerPlatformAdminDlp

Description

A new connector blocking policy is created.

Create Connector Configurations

RecordType: PowerPlatformAdminDlp

Description

A connector configuration is created for a data policy.

Create Custom Connector Patterns

RecordType: PowerPlatformAdminDlp

Description

A new custom connector URL pattern is created for a data policy.

Create Data Policy

RecordType: PowerPlatformAdminDlp

Description

A new data loss prevention (DLP) policy is created.

Create Exempt Resources (Deprecated)

RecordType: PowerPlatformAdminDlp

Description

An exempt resources list is created for a data policy. Marked deprecated in the source doc.

Delete connector blocking policy

RecordType: PowerPlatformAdminDlp

Description

A connector blocking policy is deleted.

Delete Connector Configurations

RecordType: PowerPlatformAdminDlp

Description

A connector configuration is deleted from a data policy.

Delete Custom Connector Patterns

RecordType: PowerPlatformAdminDlp

Description

A custom connector URL pattern is deleted from a data policy.

Delete Data Policy

RecordType: PowerPlatformAdminDlp

Description

A data loss prevention (DLP) policy is deleted.

Delete Exempt Resources (Deprecated)

RecordType: PowerPlatformAdminDlp

Description

An exempt resources list is deleted from a data policy. Marked deprecated in the source doc.

Update connector blocking policy

RecordType: PowerPlatformAdminDlp

Description

A connector blocking policy is updated.

Update Connector Configurations

RecordType: PowerPlatformAdminDlp

Description

A connector configuration is updated for a data policy.

Update Custom Connector Patterns

RecordType: PowerPlatformAdminDlp

Description

A custom connector URL pattern is updated for a data policy.

Update Data Policy

RecordType: PowerPlatformAdminDlp

Description

A data loss prevention (DLP) policy is updated.

Update Exempt Resources (Deprecated)

RecordType: PowerPlatformAdminDlp

Description

An exempt resources list is updated for a data policy. Marked deprecated in the source doc.

References #

M365 audit records use different field names on each surface #

The same Unified Audit Log record uses different field names on each surface. A query built for one surface can silently miss on another. These pages document the Management Activity API JSON names, the same names Search-UnifiedAuditLog and the Office 365 Management Activity API return.

Purview CSV export flattens each record to four columns (CreationDate, UserIds, Operations, AuditData). The API field names live only inside the AuditData JSON blob. Expand it with ConvertFrom-Json. The wrapper columns are renamed too: CreationDate not CreationTime, UserIds not UserId, Operations not Operation.
Sentinel's OfficeActivity table renames several fields and turns two integer enum columns into strings. The table below maps them.

API JSON (event pages)	OfficeActivity column	Note
`Id`	`OfficeId`	Renamed.
`Workload`	`OfficeWorkload`	Renamed.
`ObjectId`	`OfficeObjectId`	Renamed.
`CreationTime`	`TimeGenerated`	Renamed. OfficeActivity has no `CreationTime` column.
`SiteUrl`	`Site_Url`	Renamed (SharePoint family).
`RecordType`	`RecordType`	Same name; the Int32 enum becomes its string enum name.
`UserType`	`UserType`	Same name; the Int32 enum becomes a string.
`ClientIP`	`ClientIP`, `Client_IPAddress`	Both columns present on OfficeActivity.
`Scope`	(none)	No OfficeActivity equivalent under any name. Recover it from the API JSON or the Purview `AuditData` blob.
`Operation`, `UserId`, `ResultStatus`, `UserKey`, `AppAccessContext`, `OrganizationId`	same names	Unchanged. No `_s` / `_d` suffixes (a native table, not a custom log).

Mapping verified against the OfficeActivity table reference, the Management Activity API schema, and the Purview audit-record export format.