Configuring REST API

How to use Office 365 Management Activity API to fetch SharePoint Online audit logs

Builds 4500 and lower use the Search-UnifiedAuditLog script to fetch SharePoint Online audit logs. Using this PowerShell script has sometimes caused data inconsistencies for a few users. Starting with build 4501, users can choose to use the Office 365 Management Activity API instead to avoid missing any data. Follow the steps below to use this API to fetch the audit data.

1. If the Azure application is not configured,
   1. Create Azure application manually and update them on the product's Admin page.
   2. Save the configuration.
2. If the Azure application is already configured,
   1. Open connecDB.bat from <product-installation-directory>/bin and run the query below to get the Client ID of your Azure application.
      • Select farm_id, client_id from AzureAppCredentials;
   2. Open the Azure portal and navigate to Microsoft Entra ID → App Registrations → All applications.
   3. Search with your Client ID and open the application.
   4. Open API permissions and click Add a permission.
   5. In the pop-up, navigate to Office 365 Management APIs → Application permissions.
   6. Select ActivityFeed.Read and click Add permissions.
   7. Click on Grant admin consent for <Your Company> and give confirmation.
   
   8. Run the database query below in the connectDB console.
      • update onlineprofiles set audit_type=4;
   9. Restart SharePoint Manager Plus to apply the changes.