| title | auditData derived types |
|---|---|
| description | Lists all resource types that derive from the auditData abstract type in Microsoft Graph security. |
| author | diksha27 |
| ms.subservice | security |
| ms.localizationpriority | medium |
| doc_type | resourcePageType |
| ms.date | 03/17/2026 |
Namespace: microsoft.graph.security
[!INCLUDE beta-disclaimer]
The following resource types inherit from the auditData abstract type. Each derived type represents audit log data for a specific Microsoft 365 service or feature, returned as the auditData property of an auditLogRecord.
- a365AiExecuteTool
- a365AiInferenceCall
- a365AiInvokeAgent
- a365AiRunSummary
- a365SpanOutputs
- aadRiskDetectionAuditRecord
- aedAuditRecord
- agentAdminActivityRecord
- agentSettingAdminActivity
- aiAppInteractionAuditRecord
- aiExecuteToolAuditRecord
- aiInteractionsChangeNotificationAuditRecord
- aiInteractionsExportAuditRecord
- aiInteractionsSubscriptionAuditRecord
- aiInvokeAgentAuditRecord
- aipDiscover
- aipFileDeleted
- aipHeartBeat
- aipProtectionActionLogRequest
- aipScannerDiscoverEvent
- aipSensitivityLabelActionLogRequest
- airAdminActionInvestigationData
- airInvestigationData
- airManualInvestigationData
- attackSimAdminAuditRecord
- attackSimAuditRecord
- auditConfigAuditRecord
- auditSearchAuditRecord
- azfwApplicationRuleAggregationEventRecord
- azfwDnsQueryEventRecord
- azfwNetworkRuleEventRecord
- azureActiveDirectoryAccountLogonAuditRecord
- azureActiveDirectoryAuditRecord
- azureActiveDirectoryBaseAuditRecord
- azureActiveDirectoryStsLogonAuditRecord
- campaignAuditRecord
- caseAuditRecord
- caseInvestigation
- ccraiPolicyViolationRecord
- cdpClassifierHealthRecord
- cdpColdCrawlStatusRecord
- cdpConsumptionResourceRecord
- cdpContentExplorerAggregateRecord
- cdpdlmaiInteractionInsightsRecord
- cdpDlpSensitiveAuditRecord
- cdpDlpSensitiveEndpointAuditRecord
- cdpLogRecord
- cdpOcrBillingRecord
- cdpResourceScopeChangeEventRecord
- cernerSMSLinkRecord
- cernerSMSSettingsUpdateRecord
- cernerSMSUnlinkRecord
- cloudUpdateDeviceConfigAuditRecord
- cloudUpdateProfileConfigAuditRecord
- cloudUpdateTenantConfigAuditRecord
- complianceConnectorAuditRecord
- complianceDLMExchangeAuditRecord
- complianceDLMSharePointAuditRecord
- complianceDlpApplicationsAuditRecord
- complianceDlpApplicationsClassificationAuditRecord
- complianceDlpBaseAuditRecord
- complianceDlpClassificationBaseAuditRecord
- complianceDlpClassificationBaseCdpRecord
- complianceDlpEndpointAuditRecord
- complianceDlpEndpointDiscoveryAuditRecord
- complianceDLPEnforcementAuditRecord
- complianceDlpExchangeAuditRecord
- complianceDlpExchangeClassificationAuditRecord
- complianceDlpExchangeClassificationCdpRecord
- complianceDlpExchangeDiscoveryAuditRecord
- complianceDlpSharePointAuditRecord
- complianceDlpSharePointClassificationAuditRecord
- complianceDLPSharePointClassificationCdpRecord
- complianceDlpSharePointClassificationExtendedAuditRecord
- complianceExchangeOcrAuditRecord
- complianceManagerActionRecord
- complianceSettingsChangeAuditRecord
- complianceSupervisionBaseAuditRecord
- complianceSupervisionExchangeAuditRecord
- consumptionResourceAuditRecord
- connectedAIAppInteractionAuditRecord
- contentStoreMetadataRecord
- copilotAgentManagementAuditRecord
- copilotForSecurityLoggingAuditRecord
- copilotForSecurityTriggerAuditRecord
- copilotInteractionAuditRecord
- copilotPluginSettingAuditRecord
- copilotPromptBookSettingAuditRecord
- copilotSettingAuditRecord
- copilotWorkspaceSettingAuditRecord
- coreReportingSettingsAuditRecord
- cortanaBriefingAuditRecord
- cpsCommonPolicyAuditRecord
- cpsPolicyConfigAuditRecord
- criticalAssetManagementClassificationRecord
- crmBaseAuditRecord
- crmEntityOperationAuditRecord
- crossTenantAccessPolicyAuditRecord
- customerKeyServiceEncryptionAuditRecord
- dataCenterSecurityBaseAuditRecord
- dataCenterSecurityCmdletAuditRecord
- dataGovernanceAuditRecord
- dataInsightsRestApiAuditRecord
- dataLakeExportOperationAuditRecord
- dataSecurityInvestigationAuditRecord
- dataShareOperationAuditRecord
- defaultAuditData
- defenderCaseManagementAuditRecord
- defenderPreviewFeaturesRecord
- defenderSecurityAlertBaseRecord
- deleteCertificateRecord
- deployFeatureActivityRecord
- deviceDiscoverySettingsAuthenticatedScansRecord
- deviceDiscoverySettingsExclusionRecord
- deviceDiscoverySettingsRecord
- disableConsentRecord
- discoveryAuditRecord
- dlpEndpointAuditRecord
- dlpImportResultAuditRecord
- dlpSensitiveInformationTypeCmdletRecord
- dlpSensitiveInformationTypeRulePackageCmdletRecord
- downloadCertificateRecord
- dynamics365BusinessCentralAuditRecord
- ehrConnectorAuditBaseRecord
- enableConsentRecord
- epicSMSLinkRecord
- epicSMSSettingsUpdateRecord
- epicSMSUnlinkRecord
- exchangeAdminAuditRecord
- exchangeAggregatedMailboxAuditRecord
- exchangeAggregatedOperationRecord
- exchangeMailboxAuditBaseRecord
- exchangeMailboxAuditGroupRecord
- exchangeMailboxAuditRecord
- fabricAuditRecord
- fhirBaseUrlAddRecord
- fhirBaseUrlApproveRecord
- fhirBaseUrlDeleteRecord
- fhirBaseUrlUpdateRecord
- healthcareSignalRecord
- hostedRpaAuditRecord
- hrSignalAuditRecord
- hygieneEventRecord
- informationBarrierPolicyApplicationAuditRecord
- informationWorkerProtectionAuditRecord
- insiderRiskScopedUserInsightsRecord
- insiderRiskScopedUsersRecord
- integratedAppsAppAdminActivityAuditRecord
- integratedAppsAppSettingsAdminActivityAuditRecord
- irmActivityAuditTrailRecord
- irmSecurityAlertRecord
- irmUserDefinedDetectionRecord
- kaizalaAuditRecord
- labelAnalyticsAggregateAuditRecord
- labelContentExplorerAuditRecord
- largeContentMetadataAuditRecord
- m365ComplianceConnectorAuditRecord
- m365DAADAuditRecord
- m365odspAssetMetadataRecord
- m365SearchSectionsRecord
- mailSubmissionData
- managedServicesAuditRecord
- managedTenantsAuditRecord
- mapgAlertsAuditRecord
- mapgOnboardAuditRecord
- mapgPolicyAuditRecord
- mapgRemediationAuditRecord
- mcasAlertsAuditRecord
- mdaAuditRecord
- mdaDataSecuritySignalRecord
- mdatpAuditRecord
- mdcEventsRecord
- mdiAuditRecord
- meshWorldsAuditRecord
- microsoft365BackupBackupItemAuditRecord
- microsoft365BackupBackupPolicyAuditRecord
- microsoft365BackupGranularBrowseTaskAuditRecord
- microsoft365BackupRestoreItemAuditRecord
- microsoft365BackupRestoreTaskAuditRecord
- microsoft365CopilotScheduledPromptAuditRecord
- microsoftDefenderExpertsBaseAuditRecord
- microsoftDefenderExpertsXDRAuditRecord
- microsoftFlowAuditRecord
- microsoftFormsAuditRecord
- microsoftGraphDataConnectConsent
- microsoftGraphDataConnectOperation
- microsoftPurviewDataCatalogOperationRecord
- microsoftPurviewDataMapOperationRecord
- microsoftPurviewMetadataPolicyOperationRecord
- microsoftPurviewPolicyOperationRecord
- microsoftPurviewPrivacyAuditEvent
- microsoftPurviewUnifiedCatalogOperationRecord
- microsoftStreamAuditRecord
- microsoftTeamsAdminAuditRecord
- microsoftTeamsAnalyticsAuditRecord
- microsoftTeamsAuditRecord
- microsoftTeamsDeviceAuditRecord
- microsoftTeamsRetentionLabelActionAuditRecord
- microsoftTeamsSensitivityLabelActionAuditRecord
- microsoftTeamsShiftsAuditRecord
- mipAutoLabelExchangeItemAuditRecord
- mipAutoLabelItemAuditRecord
- mipAutoLabelPolicyAuditRecord
- mipAutoLabelProgressFeedbackAuditRecord
- mipAutoLabelSharePointItemAuditRecord
- mipAutoLabelSharePointPolicyLocationAuditRecord
- mipAutoLabelSimulationSharePointCompletionRecord
- mipAutoLabelSimulationSharePointProgressRecord
- mipAutoLabelSimulationStatisticsRecord
- mipAutoLabelSimulationStatusRecord
- mipExactDataMatchAuditRecord
- mipLabelAnalyticsAuditRecord
- mipLabelAuditRecord
- mosAgentInfoRecord
- mS365DCustomDetectionAuditRecord
- mS365DIncidentAuditRecord
- mS365DSuppressionRuleAuditRecord
- msdeCustomCollectionAuditRecord
- msdeGeneralSettingsAuditRecord
- msdeIndicatorsSettingsAuditRecord
- msdeResponseActionsAuditRecord
- msdeRolesSettingsAuditRecord
- msticNationStateNotificationRecord
- multiStageDispositionAuditRecord
- myAnalyticsSettingsAuditRecord
- noisyAlertPolicyAuditRecord
- officeNativeAuditRecord
- omePortalAuditRecord
- onDemandSharePointClassificationAuditRecord
- oneDriveAuditRecord
- onPremisesFileShareScannerDlpAuditRecord
- onPremisesScannerDlpAuditRecord
- onPremisesSharePointScannerDlpAuditRecord
- organizationalDataInM365AuditRecord
- outlookCopilotAutomationAuditRecord
- owaGetAccessTokenForResourceAuditRecord
- p4aiAssessmentCategoryRecord
- p4aiAssessmentFabricScannerRecord
- p4aiAssessmentLocationResultRecord
- p4aiAssessmentRecord
- peopleAdminSettingsAuditRecord
- physicalBadgingSignalAuditRecord
- placesDirectoryAuditRecord
- plannerChatMessageAuditRecord
- plannerChatMessageListAuditRecord
- plannerCopyPlanAuditRecord
- plannerGoalAuditRecord
- plannerGoalListAuditRecord
- plannerPlanAuditRecord
- plannerPlanListAuditRecord
- plannerPlanSensitivityLabelAuditRecord
- plannerRosterAuditRecord
- plannerRosterSensitivityLabelAuditRecord
- plannerTaskAuditRecord
- plannerTaskListAuditRecord
- plannerTenantSettingsAuditRecord
- policyConfigChangeAuditRecord
- powerAppsAuditAppRecord
- powerAppsAuditPlanRecord
- powerAppsAuditResourceRecord
- powerBiAuditRecord
- powerBiDlpAuditRecord
- powerPagesSiteAuditRecord
- powerPlatformAdminDlpAuditRecord
- powerPlatformAdminEnvironmentAuditRecord
- powerPlatformAdministratorActivityRecord
- powerPlatformLockboxResourceAccessRequestAuditRecord
- powerPlatformLockboxResourceCommandAuditRecord
- powerPlatformServiceActivityAuditRecord
- powerPlatformTenantIsolationRecord
- privacyDataMatchAuditRecord
- privacyDataMinimizationRecord
- privacyDigestEmailRecord
- privacyOpenAccessAuditRecord
- privacyPortalAuditRecord
- privacyRemediationActionRecord
- privacyRemediationRecord
- privacyTenantAuditHistoryRecord
- privaPrivacyAssessmentOperationRecord
- privaPrivacyConsentOperationRecord
- projectAuditRecord
- projectForTheWebAssignedToMeSettingsAuditRecord
- projectForTheWebProjectAuditRecord
- projectForTheWebProjectSettingsAuditRecord
- projectForTheWebRoadmapAuditRecord
- projectForTheWebRoadmapItemAuditRecord
- projectForTheWebRoadmapSettingsAuditRecord
- projectForTheWebTaskAuditRecord
- publicFolderAuditRecord
- purviewInsiderRiskAlertsRecord
- purviewInsiderRiskCasesRecord
- purviewMCRecommendationRecord
- purviewPostureAgentAuditRecord
- quarantineAuditRecord
- recordsManagementAuditRecord
- reportSubmission
- reportSubmissionResultDetail
- restrictedModeAuditRecord
- retentionPolicyAuditRecord
- rtiOperationsAgentAuditRecord
- sbpConfigurationEventRecord
- sbpUsageEventRecord
- scoreEvidence
- scorePlatformGenericAuditRecord
- scriptRunAuditRecord
- searchAuditRecord
- securityComplianceAlertRecord
- securityComplianceCenterEOPCmdletAuditRecord
- securityComplianceInsightsAuditRecord
- securityComplianceRBACAuditRecord
- securityComplianceUserChangeAuditRecord
- sensitiveInfoRemediationAgentDataRecord
- sensitivityLabelActionAuditRecord
- sensitivityLabeledFileActionAuditRecord
- sensitivityLabelPolicyMatchAuditRecord
- sentinelAIToolAuditRecord
- sentinelGraphAuditRecord
- sentinelJobAuditRecord
- sentinelKQLOnLakeAuditRecord
- sentinelLakeDataOnboardingAuditRecord
- sentinelLakeEncryptionAuditRecord
- sentinelLakeOnboardingAuditRecord
- sentinelNotebookOnLakeAuditRecord
- sentinelPackageAuditRecord
- sharePointAppPermissionOperationAuditRecord
- sharePointAuditRecord
- sharePointCommentOperationAuditRecord
- sharePointContentSecurityPolicyAuditRecord
- sharePointContentTypeOperationAuditRecord
- sharePointESignatureAuditRecord
- sharePointFieldOperationAuditRecord
- sharePointFileOperationAuditRecord
- sharePointListItemOperationAuditRecord
- sharePointListOperationAuditRecord
- sharePointSharingOperationAuditRecord
- skypeForBusinessBaseAuditRecord
- skypeForBusinessCmdletsAuditRecord
- skypeForBusinessPSTNUsageAuditRecord
- skypeForBusinessUsersBlockedAuditRecord
- smsCreatePhoneNumberRecord
- smsDeletePhoneNumberRecord
- sonarDetonationContentMetadata
- supervisoryReviewDayXInsightsAuditRecord
- syntheticProbeAuditRecord
- teamCopilotInteractionAuditRecord
- teamsEasyApprovalsAuditRecord
- teamsEvalDataHubAdminOperationAuditRecord
- teamsEvalDataHubDataAccessAuditRecord
- teamsEvalDataHubPermissionChangeAuditRecord
- teamsHealthcareAuditRecord
- teamsUpdatesAuditRecord
- tenantAllowBlockListAuditRecord
- threatFinderAuditRecord
- threatIntelligenceAtpContentData
- threatIntelligenceExportAuditRecord
- threatIntelligenceMailData
- threatIntelligenceObjectAuditRecord
- threatIntelligenceUrlClickData
- todoAuditRecord
- trainableClassifierAuditRecord
- uamOperationAuditRecord
- unifiedGroupAuditRecord
- unifiedSimulationMatchedItemAuditRecord
- unifiedSimulationSummaryAuditRecord
- universalPrintManagementAuditRecord
- universalPrintPrintJobAuditRecord
- uploadCertificateRecord
- urbacAssignmentAuditRecord
- urbacEnableStateAuditRecord
- urbacRoleAuditRecord
- userTrainingAuditRecord
- usxWorkspaceOnboardingAuditRecord
- vfamBasePolicyAuditRecord
- vfamCreatePolicyAuditRecord
- vfamDeletePolicyAuditRecord
- vfamUpdatePolicyAuditRecord
- vivaAmplifyAuditRecord
- vivaEngageEventsAuditRecord
- vivaEngageNetworkAssociationAuditRecord
- vivaEngageSegmentAuditRecord
- vivaGlintAdvancedConfigurationAuditRecord
- vivaGlintFeedbackProgramAuditRecord
- vivaGlintOrganizationalDataAuditRecord
- vivaGlintPulseProgramAuditRecord
- vivaGlintPulseProgramRespondentRateAuditRecord
- vivaGlintQuestionAuditRecord
- vivaGlintRoleAuditRecord
- vivaGlintRubiconAuditRecord
- vivaGlintSupportAccessAuditRecord
- vivaGlintSystemAuditRecord
- vivaGlintUserAuditRecord
- vivaGlintUserGroupAuditRecord
- vivaGoalsAuditRecord
- vivaLearningAdminAuditRecord
- vivaLearningAuditRecord
- vivaPulseAdminAuditRecord
- vivaPulseOrganizerAuditRecord
- vivaPulseReportAuditRecord
- vivaPulseResponseAuditRecord
- wdatpAlertsAuditRecord
- webContentFilteringAuditRecord
- windows365CustomerLockboxAuditRecord
- workplaceAnalyticsAuditRecord
- yammerAuditRecord
- yammerUserHidingAuditRecord