Microsoft Graph auditLogs.directoryAudit API

openapi: 3.2.0
info:
  title: Microsoft Graph Admin Admin.admin Audit Logs.directory Audit API
  description: 'Microsoft Graph API for managing administrative resources in Microsoft Entra ID.

    This API enables administrators to manage Microsoft Edge browser settings, Internet Explorer mode configurations,

    site lists, shared browser sites, Microsoft 365 Apps installation options, people insights, service announcements,

    SharePoint settings, Copilot administration, directory administrative units, and admin consent policies.'
  version: 1.0.0
  contact:
    name: Microsoft Graph API Support
    url: https://developer.microsoft.com/graph
servers:
- url: https://graph.microsoft.com/v1.0
  description: Microsoft Graph API v1.0 endpoint
tags:
- name: auditLogs.directoryAudit
paths:
  /auditLogs/directoryAudits:
    description: Provides operations to manage the directoryAudits property of the microsoft.graph.auditLogRoot entity.
    get:
      tags:
      - auditLogs.directoryAudit
      summary: Microsoft Graph List directoryAudits
      description: Get the list of audit logs generated by Microsoft Entra ID. This includes audit logs generated by various services within Microsoft Entra ID, including user, app, device and group Management, privileged identity management (PIM), access reviews, terms of use, identity protection, password management (self-service and admin password resets), and self- service group management, and so on.
      externalDocs:
        description: Find more info here
        url: https://learn.microsoft.com/graph/api/directoryaudit-list?view=graph-rest-1.0
      operationId: auditLogs.ListDirectoryAudits
      parameters:
      - $ref: '#/components/parameters/top'
      - $ref: '#/components/parameters/skip'
      - $ref: '#/components/parameters/search'
      - $ref: '#/components/parameters/filter'
      - $ref: '#/components/parameters/count'
      - name: $orderby
        in: query
        description: Order items by property values
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $select
        in: query
        description: Select properties to be returned
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $expand
        in: query
        description: Expand related entities
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      responses:
        2XX:
          $ref: '#/components/responses/microsoft.graph.directoryAuditCollectionResponse'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-pageable:
        nextLinkName: '@odata.nextLink'
        operationName: listMore
      x-ms-docs-operation-type: operation
    post:
      tags:
      - auditLogs.directoryAudit
      summary: Microsoft Graph Create new navigation property to directoryAudits for auditLogs
      operationId: auditLogs.CreateDirectoryAudits
      requestBody:
        description: New navigation property
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/microsoft.graph.directoryAudit'
        required: true
      responses:
        2XX:
          description: Created navigation property.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.directoryAudit'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
  /auditLogs/directoryAudits/{directoryAudit-id}:
    description: Provides operations to manage the directoryAudits property of the microsoft.graph.auditLogRoot entity.
    parameters:
    - name: directoryAudit-id
      in: path
      description: The unique identifier of directoryAudit
      required: true
      schema:
        type: string
      x-ms-docs-key-type: directoryAudit
    get:
      tags:
      - auditLogs.directoryAudit
      summary: Microsoft Graph Get directoryAudit
      description: Get a specific Microsoft Entra audit log item. This includes an audit log item generated by various services within Microsoft Entra ID like user, application, device and group management, privileged identity management (PIM), access reviews, terms of use, identity protection, password management (self-service and admin password resets), self-service group management, and so on.
      externalDocs:
        description: Find more info here
        url: https://learn.microsoft.com/graph/api/directoryaudit-get?view=graph-rest-1.0
      operationId: auditLogs.GetDirectoryAudits
      parameters:
      - name: $select
        in: query
        description: Select properties to be returned
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $expand
        in: query
        description: Expand related entities
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      responses:
        2XX:
          description: Retrieved navigation property
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.directoryAudit'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
    patch:
      tags:
      - auditLogs.directoryAudit
      summary: Microsoft Graph Update the navigation property directoryAudits in auditLogs
      operationId: auditLogs.UpdateDirectoryAudits
      requestBody:
        description: New navigation property values
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/microsoft.graph.directoryAudit'
        required: true
      responses:
        2XX:
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.directoryAudit'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
    delete:
      tags:
      - auditLogs.directoryAudit
      summary: Microsoft Graph Delete navigation property directoryAudits for auditLogs
      operationId: auditLogs.DeleteDirectoryAudits
      parameters:
      - name: If-Match
        in: header
        description: ETag
        schema:
          type: string
      responses:
        '204':
          description: Success
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
  /auditLogs/directoryAudits/$count:
    description: Provides operations to count the resources in the collection.
    get:
      tags:
      - auditLogs.directoryAudit
      summary: Microsoft Graph Get the number of the resource
      operationId: auditLogs.directoryAudits.GetCount-fedb
      parameters:
      - $ref: '#/components/parameters/search'
      - $ref: '#/components/parameters/filter'
      responses:
        2XX:
          $ref: '#/components/responses/ODataCountResponse'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
components:
  schemas:
    ODataCountResponse:
      type: integer
      format: int32
    microsoft.graph.ODataErrors.ErrorDetails:
      required:
      - code
      - message
      type: object
      properties:
        code:
          type: string
        message:
          type: string
        target:
          type: string
          nullable: true
    microsoft.graph.targetResource:
      title: targetResource
      required:
      - '@odata.type'
      type: object
      properties:
        displayName:
          type: string
          description: Indicates the visible name defined for the resource. Typically specified when the resource is created.
          nullable: true
        groupType:
          anyOf:
          - $ref: '#/components/schemas/microsoft.graph.groupType'
          - type: object
            nullable: true
          description: 'When type is set to Group, this indicates the group type. The possible values are: unifiedGroups, azureAD, and unknownFutureValue'
        id:
          type: string
          description: Indicates the unique ID of the resource.
          nullable: true
        modifiedProperties:
          type: array
          items:
            $ref: '#/components/schemas/microsoft.graph.modifiedProperty'
          description: Indicates name, old value and new value of each attribute that changed. Property values depend on the operation type.
        type:
          type: string
          description: Describes the resource type.  Example values include Application, Group, ServicePrincipal, and User.
          nullable: true
        userPrincipalName:
          type: string
          description: When type is set to User, this includes the user name that initiated the action; null for other types.
          nullable: true
        '@odata.type':
          type: string
    microsoft.graph.identity:
      title: identity
      required:
      - '@odata.type'
      type: object
      properties:
        displayName:
          type: string
          description: The display name of the identity.For drive items, the display name might not always be available or up to date. For example, if a user changes their display name the API might show the new value in a future response, but the items associated with the user don't show up as changed when using delta.
          nullable: true
        id:
          type: string
          description: Unique identifier for the identity or actor. For example, in the access reviews decisions API, this property might record the id of the principal, that is, the group, user, or application that's subject to review.
          nullable: true
        '@odata.type':
          type: string
      discriminator:
        propertyName: '@odata.type'
        mapping:
          '#microsoft.graph.azureCommunicationServicesUserIdentity': '#/components/schemas/microsoft.graph.azureCommunicationServicesUserIdentity'
          '#microsoft.graph.communicationsApplicationIdentity': '#/components/schemas/microsoft.graph.communicationsApplicationIdentity'
          '#microsoft.graph.communicationsApplicationInstanceIdentity': '#/components/schemas/microsoft.graph.communicationsApplicationInstanceIdentity'
          '#microsoft.graph.communicationsEncryptedIdentity': '#/components/schemas/microsoft.graph.communicationsEncryptedIdentity'
          '#microsoft.graph.communicationsGuestIdentity': '#/components/schemas/microsoft.graph.communicationsGuestIdentity'
          '#microsoft.graph.communicationsPhoneIdentity': '#/components/schemas/microsoft.graph.communicationsPhoneIdentity'
          '#microsoft.graph.communicationsUserIdentity': '#/components/schemas/microsoft.graph.communicationsUserIdentity'
          '#microsoft.graph.emailIdentity': '#/components/schemas/microsoft.graph.emailIdentity'
          '#microsoft.graph.initiator': '#/components/schemas/microsoft.graph.initiator'
          '#microsoft.graph.provisionedIdentity': '#/components/schemas/microsoft.graph.provisionedIdentity'
          '#microsoft.graph.provisioningServicePrincipal': '#/components/schemas/microsoft.graph.provisioningServicePrincipal'
          '#microsoft.graph.provisioningSystem': '#/components/schemas/microsoft.graph.provisioningSystem'
          '#microsoft.graph.servicePrincipalIdentity': '#/components/schemas/microsoft.graph.servicePrincipalIdentity'
          '#microsoft.graph.sharePointIdentity': '#/components/schemas/microsoft.graph.sharePointIdentity'
          '#microsoft.graph.teamworkApplicationIdentity': '#/components/schemas/microsoft.graph.teamworkApplicationIdentity'
          '#microsoft.graph.teamworkConversationIdentity': '#/components/schemas/microsoft.graph.teamworkConversationIdentity'
          '#microsoft.graph.teamworkTagIdentity': '#/components/schemas/microsoft.graph.teamworkTagIdentity'
          '#microsoft.graph.teamworkUserIdentity': '#/components/schemas/microsoft.graph.teamworkUserIdentity'
          '#microsoft.graph.userIdentity': '#/components/schemas/microsoft.graph.userIdentity'
          '#microsoft.graph.callRecords.userIdentity': '#/components/schemas/microsoft.graph.callRecords.userIdentity'
    microsoft.graph.userIdentity:
      allOf:
      - $ref: '#/components/schemas/microsoft.graph.identity'
      - title: userIdentity
        required:
        - '@odata.type'
        type: object
        properties:
          ipAddress:
            type: string
            description: Indicates the client IP address associated with the user performing the activity (audit log only).
            nullable: true
          userPrincipalName:
            type: string
            description: The userPrincipalName attribute of the user.
            nullable: true
          '@odata.type':
            type: string
            default: '#microsoft.graph.userIdentity'
      x-ms-discriminator-value: '#microsoft.graph.userIdentity'
    microsoft.graph.auditActivityInitiator:
      title: auditActivityInitiator
      required:
      - '@odata.type'
      type: object
      properties:
        app:
          anyOf:
          - $ref: '#/components/schemas/microsoft.graph.appIdentity'
          - type: object
            nullable: true
          description: If the resource initiating the activity is an app, this property indicates all the app related information like appId and name.
        user:
          anyOf:
          - $ref: '#/components/schemas/microsoft.graph.userIdentity'
          - type: object
            nullable: true
          description: If the resource initiating the activity is a user, this property Indicates all the user related information like user ID and userPrincipalName.
        '@odata.type':
          type: string
    microsoft.graph.ODataErrors.InnerError:
      title: InnerError
      required:
      - '@odata.type'
      type: object
      properties:
        request-id:
          type: string
          description: Request Id as tracked internally by the service
          nullable: true
        client-request-id:
          type: string
          description: Client request Id as sent by the client application.
          nullable: true
        date:
          pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
          type: string
          description: Date when the error occured.
          format: date-time
          nullable: true
        '@odata.type':
          type: string
    microsoft.graph.directoryAuditCollectionResponse:
      title: Collection of directoryAudit
      type: object
      allOf:
      - $ref: '#/components/schemas/BaseCollectionPaginationCountResponse'
      - type: object
        properties:
          value:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.directoryAudit'
    microsoft.graph.groupType:
      title: groupType
      enum:
      - unifiedGroups
      - azureAD
      - unknownFutureValue
      type: string
    microsoft.graph.operationResult:
      title: operationResult
      enum:
      - success
      - failure
      - timeout
      - unknownFutureValue
      type: string
    microsoft.graph.ODataErrors.MainError:
      required:
      - code
      - message
      type: object
      properties:
        code:
          type: string
        message:
          type: string
          x-ms-primary-error-message: true
        target:
          type: string
          nullable: true
        details:
          type: array
          items:
            $ref: '#/components/schemas/microsoft.graph.ODataErrors.ErrorDetails'
        innerError:
          $ref: '#/components/schemas/microsoft.graph.ODataErrors.InnerError'
    microsoft.graph.appIdentity:
      title: appIdentity
      required:
      - '@odata.type'
      type: object
      properties:
        appId:
          type: string
          description: Refers to the unique ID representing application in Microsoft Entra ID.
          nullable: true
        displayName:
          type: string
          description: Refers to the application name displayed in the Microsoft Entra admin center.
          nullable: true
        servicePrincipalId:
          type: string
          description: Refers to the unique ID for the service principal in Microsoft Entra ID.
          nullable: true
        servicePrincipalName:
          type: string
          description: Refers to the Service Principal Name is the Application name in the tenant.
          nullable: true
        '@odata.type':
          type: string
    microsoft.graph.modifiedProperty:
      title: modifiedProperty
      required:
      - '@odata.type'
      type: object
      properties:
        displayName:
          type: string
          description: Indicates the property name of the target attribute that was changed.
          nullable: true
        newValue:
          type: string
          description: Indicates the updated value for the propery.
          nullable: true
        oldValue:
          type: string
          description: Indicates the previous value (before the update) for the property.
          nullable: true
        '@odata.type':
          type: string
    microsoft.graph.directoryAudit:
      allOf:
      - $ref: '#/components/schemas/microsoft.graph.entity'
      - title: directoryAudit
        required:
        - '@odata.type'
        type: object
        properties:
          activityDateTime:
            pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
            type: string
            description: Indicates the date and time the activity was performed. The Timestamp type is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Supports $filter (eq, ge, le) and $orderby.
            format: date-time
          activityDisplayName:
            type: string
            description: 'Indicates the activity name or the operation name (examples: ''Create User'' and ''Add member to group''). For a list of activities logged, refer to Microsoft Entra audit log categories and activities. Supports $filter (eq, startswith).'
          additionalDetails:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.keyValue'
            description: Indicates additional details on the activity.
          category:
            type: string
            description: 'Indicates which resource category that''s targeted by the activity. For example: UserManagement, GroupManagement, ApplicationManagement, RoleManagement. For a list of categories for activities logged, refer to Microsoft Entra audit log categories and activities.'
          correlationId:
            type: string
            description: Indicates a unique ID that helps correlate activities that span across various services. Can be used to trace logs across services. Supports $filter (eq).
            nullable: true
          initiatedBy:
            $ref: '#/components/schemas/microsoft.graph.auditActivityInitiator'
          loggedByService:
            type: string
            description: 'Indicates information on which service initiated the activity (For example: Self-service Password Management, Core Directory, B2C, Invited Users, Microsoft Identity Manager, Privileged Identity Management. Supports $filter (eq).'
            nullable: true
          operationType:
            type: string
            description: 'Indicates the type of operation that was performed. The possible values include but are not limited to the following: Add, Assign, Update, Unassign, and Delete.'
            nullable: true
          result:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.operationResult'
            - type: object
              nullable: true
            description: 'Indicates the result of the activity. The possible values are: success, failure, timeout, unknownFutureValue.'
          resultReason:
            type: string
            description: Indicates the reason for failure if the result is failure or timeout.
            nullable: true
          targetResources:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.targetResource'
            description: Indicates information on which resource was changed due to the activity. Target Resource Type can be User, Device, Directory, App, Role, Group, Policy or Other. Supports $filter (eq) for id and displayName; and $filter (startswith) for displayName.
          '@odata.type':
            type: string
      x-ms-discriminator-value: '#microsoft.graph.directoryAudit'
    microsoft.graph.keyValue:
      title: keyValue
      required:
      - '@odata.type'
      type: object
      properties:
        key:
          type: string
          description: Key for the key-value pair.
          nullable: true
        value:
          type: string
          description: Value for the key-value pair.
          nullable: true
        '@odata.type':
          type: string
    BaseCollectionPaginationCountResponse:
      title: Base collection pagination and count responses
      type: object
      properties:
        '@odata.count':
          type: integer
          format: int64
          nullable: true
        '@odata.nextLink':
          type: string
          nullable: true
    microsoft.graph.ODataErrors.ODataError:
      required:
      - error
      type: object
      properties:
        error:
          $ref: '#/components/schemas/microsoft.graph.ODataErrors.MainError'
    microsoft.graph.entity:
      title: entity
      required:
      - '@odata.type'
      type: object
      properties:
        id:
          type: string
          description: The unique identifier for an entity. Read-only.
        '@odata.type':
          type: string
      discriminator:
        propertyName: '@odata.type'
        mapping:
          '#microsoft.graph.accessPackage': '#/components/schemas/microsoft.graph.accessPackage'
          '#microsoft.graph.accessPackageAssignment': '#/components/schemas/microsoft.graph.accessPackageAssignment'
          '#microsoft.graph.accessPackageAssignmentPolicy': '#/components/schemas/microsoft.graph.accessPackageAssignmentPolicy'
          '#microsoft.graph.accessPackageAssignmentRequest': '#/components/schemas/microsoft.graph.accessPackageAssignmentRequest'
          '#microsoft.graph.accessPackageCatalog': '#/components/schemas/microsoft.graph.accessPackageCatalog'
          '#microsoft.graph.accessPackageQuestion': '#/components/schemas/microsoft.graph.accessPackageQuestion'
          '#microsoft.graph.accessPackageMultipleChoiceQuestion': '#/components/schemas/microsoft.graph.accessPackageMultipleChoiceQuestion'
          '#microsoft.graph.accessPackageTextInputQuestion': '#/components/schemas/microsoft.graph.accessPackageTextInputQuestion'
          '#microsoft.graph.accessPackageResource': '#/components/schemas/microsoft.graph.accessPackageResource'
          '#microsoft.graph.accessPackageResourceEnvironment': '#/components/schemas/microsoft.graph.accessPackageResourceEnvironment'
          '#microsoft.graph.accessPackageResourceRequest': '#/components/schemas/microsoft.graph.accessPackageResourceRequest'
          '#microsoft.graph.accessPackageResourceRole': '#/components/schemas/microsoft.graph.accessPackageResourceRole'
          '#microsoft.graph.accessPackageResourceRoleScope': '#/components/schemas/microsoft.graph.accessPackageResourceRoleScope'
          '#microsoft.graph.accessPackageResourceScope': '#/components/schemas/microsoft.graph.accessPackageResourceScope'
          '#microsoft.graph.accessPackageSubject': '#/components/schemas/microsoft.graph.accessPackageSubject'
          '#microsoft.graph.accessReviewHistoryDefinition': '#/components/schemas/microsoft.graph.accessReviewHistoryDefinition'
          '#microsoft.graph.accessReviewHistoryInstance': '#/components/schemas/microsoft.graph.accessReviewHistoryInstance'
          '#microsoft.graph.accessReviewInstance': '#/components/schemas/microsoft.graph.accessReviewInstance'
          '#microsoft.graph.accessReviewInstanceDecisionItem': '#/components/schemas/microsoft.graph.accessReviewInstanceDecisionItem'
          '#microsoft.graph.accessReviewReviewer': '#/components/schemas/microsoft.graph.accessReviewReviewer'
          '#microsoft.graph.accessReviewScheduleDefinition': '#/components/schemas/microsoft.graph.accessReviewScheduleDefinition'
          '#microsoft.graph.accessReviewSet': '#/components/schemas/microsoft.graph.accessReviewSet'
          '#microsoft.graph.accessReviewStage': '#/components/schemas/microsoft.graph.accessReviewStage'
          '#microsoft.graph.activitiesContainer': '#/components/schemas/microsoft.graph.activitiesContainer'
          '#microsoft.graph.activityHistoryItem': '#/components/schemas/microsoft.graph.activityHistoryItem'
          '#microsoft.graph.adminConsentRequestPolicy': '#/components/schemas/microsoft.graph.adminConsentRequestPolicy'
          '#microsoft.graph.adminMicrosoft365Apps': '#/components/schemas/microsoft.graph.adminMicrosoft365Apps'
          '#microsoft.graph.adminReportSettings': '#/components/schemas/microsoft.graph.adminReportSettings'
          '#microsoft.graph.agreement': '#/components/schemas/microsoft.graph.agreement'
          '#microsoft.graph.agreementAcceptance': '#/components/schemas/microsoft.graph.agreementAcceptance'
          '#microsoft.graph.agreementFileProperties': '#/components/schemas/microsoft.graph.agreementFileProperties'
          '#microsoft.graph.agreementFile': '#/components/schemas/microsoft.graph.agreementFile'
          '#microsoft.graph.agreementFileLocalization': '#/components/schemas/microsoft.graph.agreementFileLocalization'
          '#microsoft.graph.agreementFileVersion': '#/components/schemas/microsoft.graph.agreementFileVersion'
          '#microsoft.graph.aiInteraction': '#/components/schemas/microsoft.graph.aiInteraction'
          '#microsoft.graph.aiInteractionHistory': '#/components/schemas/microsoft.graph.aiInteractionHistory'
          '#microsoft.graph.aiUser': '#/components/schemas/microsoft.graph.aiUser'
          '#microsoft.graph.alert': '#/components/schemas/microsoft.graph.alert'
          '#microsoft.graph.allowedValue': '#/components/schemas/microsoft.graph.allowedValue'
          '#microsoft.graph.appCatalogs': '#/components/schemas/microsoft.graph.appCatalogs'
          '#microsoft.graph.appConsentApprovalRoute': '#/components/schemas/microsoft.graph.appConsentApprovalRoute'
          '#microsoft.graph.appConsentRequest': '#/components/schemas/microsoft.graph.appConsentRequest'
          '#microsoft.graph.applePushNotificationCertificate': '#/components/schemas/microsoft.graph.applePushNotificationCertificate'
          '#microsoft.graph.applicationTemplate': '#/components/schemas/microsoft.graph.applicationTemplate'
          '#microsoft.graph.appLogCollectionRequest': '#/components/schemas/microsoft.graph.appLogCollectionRequest'
          '#microsoft.graph.approval': '#/components/schemas/microsoft.graph.approval'
          '#microsoft.graph.approvalStage': '#/components/schemas/microsoft.graph.approvalStage'
          '#microsoft.graph.appScope': '#/components/schemas/microsoft.graph.appScope'
          '#microsoft.graph.attachment': '#/components/schemas/microsoft.graph.attachment'
          '#microsoft.graph.fileAttachment': '#/components/schemas/microsoft.graph.fileAttachment'
          '#microsoft.graph.itemAttachment': '#/components/schemas/microsoft.graph.itemAttachment'
          '#microsoft.graph.referenceAttachment': '#/components/schemas/microsoft.graph.referenceAttachment'
          '#microsoft.graph.attachmentBase': '#/components/schemas/microsoft.graph.attachmentBase'
          '#microsoft.graph.taskFileAttachment': '#/components/schemas/microsoft.graph.taskFileAttachment'
          '#microsoft.graph.attachmentSession': '#/components/schemas/microsoft.graph.attachmentSession'
          '#microsoft.graph.attackSimulationRoot': '#/components/schemas/microsoft.graph.attackSimulationRoot'
          '#microsoft.graph.attendanceRecord': '#/components/schemas/microsoft.graph.attendanceRecord'
          '#microsoft.graph.attributeMappingFunctionSchema': '#/components/schemas/microsoft.graph.attributeMappingFunctionSchema'
          '#microsoft.graph.attributeSet': '#/components/schemas/microsoft.graph.attributeSet'
          '#microsoft.graph.audioRoutingGroup': '#/components/schemas/microsoft.graph.audioRoutingGroup'
          '#microsoft.graph.auditEvent': '#/components/schemas/microsoft.graph.auditEvent'
          '#microsoft.graph.auditLogRoot': '#/components/schemas/microsoft.graph.auditLogRoot'
          '#microsoft.graph.authentication': '#/components/schemas/microsoft.graph.authentication'
          '#microsoft.graph.authenticationCombinationConfiguration': '#/components/schemas/microsoft.graph.authenticationCombinationConfiguration'
          '#microsoft.graph.fido2CombinationConfiguration': '#/components/schemas/microsoft.graph.fido2CombinationConfiguration'
          '#microsoft.graph.x509CertificateCombinationConfiguration': '#/components/schemas/microsoft.graph.x509CertificateCombinationConfiguration'
          '#microsoft.graph.authenticationContextClassReference': '#/components/schemas/microsoft.graph.authenticationContextClassReference'
          '#microsoft.graph.authenticationEventListener': '#/components/schemas/microsoft.graph.authenticationEventListener'
          '#microsoft.graph.onAttributeCollectionListener': '#/components/schemas/microsoft.graph.onAttributeCollectionListener'
          '#microsoft.graph.onAttributeCollectionStartListener': '#/components/schemas/microsoft.graph.onAttributeCollectionStartListener'
          '#microsoft.graph.onAttributeCollectionSubmitListener': '#/components/schemas/microsoft.graph.onAttributeCollectionSubmitListener'
          '#microsoft.graph.onAuthenticationMethodLoadStartListener': '#/components/schemas/microsoft.graph.onAuthenticationMethodLoadStartListener'
          '#microsoft.graph.onEmailOtpSendListener': '#/components/schemas/microsoft.graph.onEmailOtpSendListener'
          '#microsoft.graph.onFraudProtectionLoadStartListener': '#/components/schemas/microsoft.graph.onFraudProtectionLoadStartListener'
          '#microsoft.graph.onInteractiveAuthFlowStartListener': '#/components/schemas/microsoft.graph.onInteractiveAuthFlowStartListener'
          '#microsoft.graph.onTokenIssuanceStartListener': '#/components/schemas/microsoft.graph.onTokenIssuanceStartListener'
          '#microsoft.graph.onUserCreateStartListener': '#/components/schemas/microsoft.graph.onUserCreateStartListener'
          '#microsoft.graph.authenticationEventsFlow': '#/components/schemas/microsoft.graph.authenticationEventsFlow'
          '#microsoft.graph.externalUsersSelfServiceSignUpEventsFlow': '#/components/schemas/microsoft.graph.externalUsersSelfServiceSignUpEventsFlow'
          '#microsoft.graph.authenticationFlowsPolicy': '#/components/schemas/microsoft.graph.authenticationFlowsPolicy'
          '#microsoft.graph.authenticationMethod': '#/components/schemas/microsoft.graph.authenticationMethod'
          '#microsoft.graph.emailAuthenticationMethod': '#/components/schemas/microsoft.graph.emailAuthenticationMethod'
          '#microsoft.graph.fido2AuthenticationMethod': '#/components/schemas/microsoft.graph.fido2AuthenticationMethod'
          '#microsoft.graph.microsoftAuthenticatorAuthenticationMethod': '#/components/schemas/microsoft.graph.microsoftAuthenticatorAuthenticationMethod'
          '#microsoft.graph.passwordAuthenticationMethod': '#/components/schemas/microsoft.graph.passwordAuthenticationMethod'
          '#microsoft.graph.phoneAuthenticationMethod': '#/components/schemas/microsoft.graph.phoneAuthent

# --- truncated at 32 KB (144 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/microsoft-graph/refs/heads/main/openapi/microsoft-graph-auditlogs-directoryaudit-api-openapi.yml