audit_log_search_start
Submit an asynchronous Microsoft Purview audit log search to see what a session did after sign-in, such as files downloaded, mailbox rules, or directory changes. Returns a query_id to poll for results.
Instructions
Start a Microsoft Purview audit log search: what was done in OneDrive/SharePoint, Exchange, Entra.
The follow-up to a confirmed takeover: the sign-in log shows which
resources a session obtained tokens for, this shows what it then did (files
opened or downloaded, mailbox rules and cmdlets, directory changes). A
search runs asynchronously in Microsoft 365 and usually takes several
minutes, so this only submits it (Graph POST /security/auditLog/queries)
and returns query_id; call audit_log_search_result with that id (and
the same tenant) until done is true.
The call creates a saved audit search object in the tenant (listed in the
Purview audit search page); it changes no directory, mailbox or file data.
Each call counts against the tenant's audit search limits (searches per
day, searches running at once): a 429 comes back as rate_limited: true
and is not retried. At least one filter besides the window is required, so
a call never searches the whole tenant's log. The filters combine with AND.
Needs the application permission AuditLogsQuery.Read.All, or the
service-scoped AuditLogsQuery-OneDrive.Read.All /
-SharePoint.Read.All / -Exchange.Read.All / -Entra.Read.All
(then set service to match). A 403 returns missing_permission.
created is true, false (nothing was created), or null (the answer was
lost; a search may exist anyway).
Args:
user: Only records of this userPrincipalName.
hours: How far back from end (or now) to search, clamped to [1, 4320] (180 days). Ignored with start.
start: Window start, ISO 8601 with an offset (e.g. 2026-10-21T22:00:00+09:00).
end: Window end, ISO 8601 with an offset (default: now).
record_types: auditLogRecordType values, e.g. ["sharePointFileOperation", "exchangeItem"].
operations: Operation names, e.g. ["FileDownloaded", "New-InboxRule", "MailItemsAccessed"].
ip_addresses: Client IPv4/IPv6 addresses.
keyword: Free text matched against the workload-specific content of each record (auditData), not
against indexed properties such as the operation name; use operations for those (at most 256 characters).
service: One workload, e.g. "Exchange", "SharePoint", "OneDrive", "AzureActiveDirectory".
object_ids: Object ids, e.g. a file URL or a mailbox item id.
tenant: Tenant to search: a [tenant.] section name, one of its domains or its tenant id
(default: the tenant claiming the user's domain, else the default tenant).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| end | No | ||
| user | No | ||
| hours | No | ||
| start | No | ||
| tenant | No | ||
| keyword | No | ||
| service | No | ||
| object_ids | No | ||
| operations | No | ||
| ip_addresses | No | ||
| record_types | No |