Skip to content

Commit 7b0a830

Browse files
samuelbenichouSamuelBenichou
samuelbenichou
and
SamuelBenichou
authored
Add windows auditing config (#28525)
* Add windows auditing config * Fix comment * Fix comments --------- Co-authored-by: SamuelBenichou <sbenichou@microsoft.com>
1 parent 68d9d18 commit 7b0a830

11 files changed

Lines changed: 364 additions & 8 deletions

‎api-reference/v1.0/api/security-autoauditingconfiguration-get.md‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
---
2+
title: "Get autoAuditingConfiguration"
3+
description: "Read the properties and relationships of microsoft.graph.security.autoAuditingConfiguration object."
4+
author: "SamuelBenichou"
5+
ms.date: 03/26/2026
6+
ms.localizationpriority: medium
7+
ms.subservice: "security"
8+
doc_type: apiPageType
9+
---
10+
11+
# Get autoAuditingConfiguration
12+
13+
Namespace: microsoft.graph.security
14+
15+
16+
Get the properties and relationships of [microsoft.graph.security.autoAuditingConfiguration](../resources/security-autoauditingconfiguration.md) object.
17+
18+
## Permissions
19+
20+
Choose the permission or permissions marked as least privileged for this API. Use a higher privileged permission or permissions [only if your app requires it](/graph/permissions-overview#best-practices-for-using-microsoft-graph-permissions). For details about delegated and application permissions, see [Permission types](/graph/permissions-overview#permission-types). To learn more about these permissions, see the [permissions reference](/graph/permissions-reference).
21+
22+
<!-- {
23+
"blockType": "permissions",
24+
"name": "security-autoauditingconfiguration-get-permissions"
25+
}
26+
-->
27+
[!INCLUDE [permissions-table](../includes/permissions/security-autoauditingconfiguration-get-permissions.md)]
28+
29+
[!INCLUDE [rbac-mdi-apis](../includes/rbac-for-apis/rbac-mdi-apis.md)]
30+
31+
## HTTP request
32+
33+
<!-- {
34+
"blockType": "ignored"
35+
}
36+
-->
37+
``` http
38+
GET /security/identities/settings/autoAuditingConfiguration
39+
```
40+
41+
## Optional query parameters
42+
43+
Not supported.
44+
45+
## Request headers
46+
47+
|Name|Description|
48+
|:---|:---|
49+
|Authorization|Bearer {token}. Required. Learn more about [authentication and authorization](/graph/auth/auth-concepts).|
50+
51+
## Request body
52+
53+
Don't supply a request body for this method.
54+
55+
## Response
56+
57+
If successful, this method returns a `200 OK` response code and a [microsoft.graph.security.autoAuditingConfiguration](../resources/security-autoauditingconfiguration.md) object in the response body.
58+
59+
## Examples
60+
61+
### Request
62+
63+
The following example shows a request.
64+
<!-- {
65+
"blockType": "request",
66+
"name": "get_autoauditingconfiguration"
67+
}
68+
-->
69+
``` http
70+
GET https://graph.microsoft.com/v1.0/security/identities/settings/autoAuditingConfiguration
71+
```
72+
73+
74+
### Response
75+
76+
The following example shows the response.
77+
>**Note:** The response object shown here might be shortened for readability.
78+
<!-- {
79+
"blockType": "response",
80+
"truncated": true,
81+
"@odata.type": "microsoft.graph.security.autoAuditingConfiguration"
82+
}
83+
-->
84+
``` http
85+
HTTP/1.1 200 OK
86+
Content-Type: application/json
87+
88+
{
89+
"value": {
90+
"@odata.type": "#microsoft.graph.security.autoAuditingConfiguration",
91+
"isAutomatic": true
92+
}
93+
}
94+
```
95+

‎api-reference/v1.0/api/security-autoauditingconfiguration-update.md‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
---
2+
title: "Update autoAuditingConfiguration"
3+
description: "Update the properties of a autoAuditingConfiguration object."
4+
author: "SamuelBenichou"
5+
ms.date: 03/26/2026
6+
ms.localizationpriority: medium
7+
ms.subservice: "security"
8+
doc_type: apiPageType
9+
---
10+
11+
# Update autoAuditingConfiguration
12+
13+
Namespace: microsoft.graph.security
14+
15+
Update the properties of an [autoAuditingConfiguration](../resources/security-autoauditingconfiguration.md) object.
16+
17+
## Permissions
18+
19+
Choose the permission or permissions marked as least privileged for this API. Use a higher privileged permission or permissions [only if your app requires it](/graph/permissions-overview#best-practices-for-using-microsoft-graph-permissions). For details about delegated and application permissions, see [Permission types](/graph/permissions-overview#permission-types). To learn more about these permissions, see the [permissions reference](/graph/permissions-reference).
20+
21+
<!-- {
22+
"blockType": "permissions",
23+
"name": "security-autoauditingconfiguration-update-permissions"
24+
}
25+
-->
26+
[!INCLUDE [permissions-table](../includes/permissions/security-autoauditingconfiguration-update-permissions.md)]
27+
28+
[!INCLUDE [rbac-mdi-apis](../includes/rbac-for-apis/rbac-mdi-apis.md)]
29+
30+
## HTTP request
31+
32+
<!-- {
33+
"blockType": "ignored"
34+
}
35+
-->
36+
``` http
37+
PATCH /security/identities/settings/autoAuditingConfiguration
38+
```
39+
40+
## Request headers
41+
42+
|Name|Description|
43+
|:---|:---|
44+
|Authorization|Bearer {token}. Required. Learn more about [authentication and authorization](/graph/auth/auth-concepts).|
45+
|Content-Type|application/json. Required.|
46+
47+
## Request body
48+
49+
50+
|Property|Type|Description|
51+
|:---|:---|:---|
52+
|isAutomatic|Boolean| Required.|
53+
54+
55+
56+
## Response
57+
58+
If successful, this method returns a `200 OK` response code.
59+
60+
## Examples
61+
62+
### Request
63+
64+
The following example shows a request.
65+
<!-- {
66+
"blockType": "request",
67+
"name": "update_autoauditingconfiguration"
68+
}
69+
-->
70+
``` http
71+
PATCH https://graph.microsoft.com/v1.0/security/identities/settings/autoAuditingConfiguration
72+
Content-Type: application/json
73+
74+
{
75+
"@odata.type": "#microsoft.graph.security.autoAuditingConfiguration",
76+
"isAutomatic": true
77+
}
78+
```
79+
80+
81+
### Response
82+
83+
The following example shows the response.
84+
>**Note:** The response object shown here might be shortened for readability.
85+
<!-- {
86+
"blockType": "response",
87+
"truncated": true
88+
}
89+
-->
90+
``` http
91+
HTTP/1.1 200 OK
92+
```

‎api-reference/v1.0/includes/permissions/security-autoauditingconfiguration-get-permissions.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
---
2+
description: Automatically generated file. DO NOT MODIFY
3+
ms.topic: include
4+
ms.localizationpriority: medium
5+
---
6+
7+
|Permission type|Least privileged permissions|Higher privileged permissions|
8+
|:---|:---|:---|
9+
|Delegated (work or school account)| SecurityIdentitiesAutoConfig.Read.All | Not available. |
10+
|Delegated (personal Microsoft account)| Not supported. | Not supported. |
11+
|Application| SecurityIdentitiesAutoConfig.Read.All | Not available. |

‎api-reference/v1.0/includes/permissions/security-autoauditingconfiguration-update-permissions.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
---
2+
description: Automatically generated file. DO NOT MODIFY
3+
ms.topic: include
4+
ms.localizationpriority: medium
5+
---
6+
7+
|Permission type|Least privileged permission|Higher privileged permissions|
8+
|:---|:---|:---|
9+
|Delegated (work or school account)|SecurityIdentitiesAutoConfig.ReadWrite.All|Not available.|
10+
|Delegated (personal Microsoft account)|Not supported.|Not supported.|
11+
|Application|SecurityIdentitiesAutoConfig.ReadWrite.All|Not available.|

‎api-reference/v1.0/resources/security-api-overview.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -141,6 +141,11 @@ The Defender for Identity sensors management APIs allows you to:
141141
- Manage sensor settings, such as adding descriptions, enabling or disabling delayed updates, and specifying the domain controller that the sensor connects to for querying Entra ID.
142142
- Identify sensors that are ready to be activated.
143143
- Define whether the sensors in your infrastructure are to be activated automatically or manually.
144+
- Identify servers that are ready to be activated with the unified agent.
145+
- Enable or disable the automatic activation of eligible servers for the unified agent.
146+
- Activate or deactivate the unified agent on eligible servers.
147+
- Enable or disable the automatic enabling of the required events auditing configuration during the sensor’s activation.
148+
144149

145150
### identityAccounts
146151
The [identityAccounts resource and related APIs](../resources/security-identityaccounts.md) allows you to retrieve details of users that are flagged by Microsoft Defender for Identity alerts, and apply actions such as disabling accounts and resetting the user password for the compromised user.

‎api-reference/v1.0/resources/security-autoauditingconfiguration.md‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
---
2+
title: "autoAuditingConfiguration resource type"
3+
description: "Represents the configuration settings for automatic auditing in Microsoft Defender for Identity."
4+
author: "SamuelBenichou"
5+
ms.date: 03/26/2026
6+
ms.localizationpriority: medium
7+
ms.subservice: "security"
8+
doc_type: resourcePageType
9+
---
10+
11+
# autoAuditingConfiguration resource type
12+
13+
Namespace: microsoft.graph.security
14+
15+
Represents the configuration settings for automatic auditing in Microsoft Defender for Identity. The config activates predefined audit policies that automatically log critical security events in Windows Event Viewer. For more information, see [Configure audit policies for Windows event logs](/defender-for-identity/deploy/configure-windows-event-collection).
16+
17+
Inherits from [microsoft.graph.entity](../resources/entity.md).
18+
19+
20+
## Methods
21+
|Method|Return type|Description|
22+
|:---|:---|:---|
23+
|[Get](../api/security-autoauditingconfiguration-get.md)|[microsoft.graph.security.autoAuditingConfiguration](../resources/security-autoauditingconfiguration.md)| Read the properties and relationships of [microsoft.graph.security.autoAuditingConfiguration](../resources/security-autoauditingconfiguration.md) object.|
24+
|[Update](../api/security-autoauditingconfiguration-update.md)|[microsoft.graph.security.autoAuditingConfiguration](../resources/security-autoauditingconfiguration.md)| Update the properties of an autoAuditingConfiguration object. |
25+
26+
## Properties
27+
|Property|Type|Description|
28+
|:---|:---|:---|
29+
|isAutomatic|Boolean|Indicates whether automatic auditing is enabled for Defender for Identity monitoring.|
30+
31+
## Relationships
32+
None.
33+
34+
## JSON representation
35+
The following JSON representation shows the resource type.
36+
<!-- {
37+
"blockType": "resource",
38+
"keyProperty": "id",
39+
"@odata.type": "microsoft.graph.security.autoAuditingConfiguration",
40+
"baseType": "microsoft.graph.entity",
41+
"openType": false
42+
}
43+
-->
44+
``` json
45+
{
46+
"@odata.type": "#microsoft.graph.security.autoAuditingConfiguration",
47+
"isAutomatic": "Boolean"
48+
}
49+
```

‎api-reference/v1.0/resources/security-identitycontainer.md‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -24,13 +24,14 @@ None.
2424

2525
## Relationships
2626

27-
| Relationship |Type|Description|
28-
|:---------------------------------------|:---|:---|
29-
| healthIssues |[microsoft.graph.security.healthIssue](security-healthissue.md) collection| Represents potential issues identified by Microsoft Defender for Identity within a customer's Microsoft Defender for Identity configuration. |
30-
| identityAccounts| [microsoft.graph.security.identityAccounts](security-identityaccounts.md) collection | Represents an identity's details in the context of Microsoft Defender for Identity. |
31-
| sensors |[microsoft.graph.security.sensor](security-sensor.md) collection| Represents a customer's Microsoft Defender for Identity sensors.|
32-
| sensorCandidates |[microsoft.graph.security.sensorCandidate](security-sensorcandidate.md) collection| Represents Microsoft Defender for Identity sensors that are ready to be activated. |
33-
| sensorCandidateActivationConfiguration |[microsoft.graph.security.sensorCandidateActivationConfiguration](security-sensorcandidateactivationconfiguration.md) collection| Represents the activation mode of a Microsoft Defender for Identity sensor. |
27+
| Relationship | Type | Description |
28+
|:---------------------------------------|:---------------------------------------------------------------------------------------------------------------------------------|:-----------------------------------------------------------------------------------------------------------------------------------------------|
29+
| healthIssues | [microsoft.graph.security.healthIssue](security-healthissue.md) collection | Represents potential issues identified by Microsoft Defender for Identity within a customer's Microsoft Defender for Identity configuration. |
30+
| identityAccounts | [microsoft.graph.security.identityAccounts](security-identityaccounts.md) collection | Represents an identity's details in the context of Microsoft Defender for Identity. |
31+
| sensors | [microsoft.graph.security.sensor](security-sensor.md) collection | Represents a customer's Microsoft Defender for Identity sensors. |
32+
| sensorCandidates | [microsoft.graph.security.sensorCandidate](security-sensorcandidate.md) collection | Represents Microsoft Defender for Identity sensors that are ready to be activated. |
33+
| sensorCandidateActivationConfiguration | [microsoft.graph.security.sensorCandidateActivationConfiguration](security-sensorcandidateactivationconfiguration.md) collection | Represents the activation mode of a Microsoft Defender for Identity sensor. |
34+
| settings | [microsoft.graph.security.settingsContainer](security-settingscontainer.md) | Represents a container for security identities settings APIs. |
3435

3536
## JSON representation
3637

‎api-reference/v1.0/resources/security-settingscontainer.md‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
---
2+
title: "settingsContainer resource type"
3+
description: "Represents a container for security settings APIs."
4+
author: "SamuelBenichou"
5+
ms.date: 03/26/2026
6+
ms.localizationpriority: medium
7+
ms.subservice: "security"
8+
doc_type: resourcePageType
9+
---
10+
11+
# settingsContainer resource type
12+
13+
Namespace: microsoft.graph.security
14+
15+
Represents a container for security identities APIs that currently exposes the [autoAuditingConfiguration](security-autoauditingconfiguration.md) relationship.
16+
17+
## Methods
18+
19+
None
20+
21+
## Properties
22+
23+
None
24+
25+
## Relationships
26+
|Relationship|Type|Description|
27+
|:---|:---|:---|
28+
|autoAuditingConfiguration|[microsoft.graph.security.autoAuditingConfiguration](../resources/security-autoauditingconfiguration.md)|Represents automatic configuration for collection of Windows event logs as needed for Defender for Identity sensors.|
29+
30+
## JSON representation
31+
The following JSON representation shows the resource type.
32+
<!-- {
33+
"blockType": "resource",
34+
"keyProperty": "id",
35+
"@odata.type": "microsoft.graph.security.settingsContainer",
36+
"baseType": "microsoft.graph.entity",
37+
"openType": false
38+
}
39+
-->
40+
``` json
41+
{
42+
"@odata.type": "#microsoft.graph.security.settingsContainer"
43+
}
44+
```

‎api-reference/v1.0/toc/toc.mapping.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1765,7 +1765,8 @@
17651765
"microsoft.graph.security.sensor",
17661766
"microsoft.graph.security.sensorCandidate",
17671767
"microsoft.graph.security.sensorCandidateActivationConfiguration",
1768-
"microsoft.graph.security.identityAccounts"
1768+
"microsoft.graph.security.identityAccounts",
1769+
"microsoft.graph.security.autoAuditingConfiguration"
17691770
],
17701771
"complexTypes": [
17711772
"microsoft.graph.security.deploymentAccessKeyType",

0 commit comments

Comments
 (0)