m365_admin_audit_log
Hourly export of M365 unified audit log filtered to admin actions. Becomes invaluable during incident response.
Microsoft 365
AU-2AU-3AU-12NIST 800-171ISO 27001
Runs (recent)
30
30 succeeded · 0 failed
Items collected
30
Bytes collected
939.9 KB
Schedule
5 * * * *
Connector configuration
The YAML the runner expanded into a connector binding
{
"filter": "admin_only",
"tenant": "acme.onmicrosoft.com"
}Recent runs
30 most recent runs
| Started | Status | Items | Bytes | Duration | Trigger |
|---|---|---|---|---|---|
| 5/2/2026, 7:07:57 PM | succeeded | 1 | 51.9 KB | 2.7 s | cron |
| 5/2/2026, 6:07:57 PM | succeeded | 1 | 55.1 KB | 5.9 s | cron |
| 5/2/2026, 5:07:57 PM | succeeded | 1 | 15.9 KB | 5.1 s | cron |
| 5/2/2026, 4:07:57 PM | succeeded | 1 | 23.1 KB | 3.7 s | cron |
| 5/2/2026, 3:07:57 PM | succeeded | 1 | 51.3 KB | 3.7 s | cron |
| 5/2/2026, 2:07:57 PM | succeeded | 1 | 5.0 KB | 3.6 s | cron |
| 5/2/2026, 1:07:57 PM | succeeded | 1 | 23.6 KB | 5.2 s | cron |
| 5/2/2026, 12:07:57 PM | succeeded | 1 | 46.5 KB | 5.9 s | cron |
| 5/2/2026, 11:07:57 AM | succeeded | 1 | 17.4 KB | 1.6 s | cron |
| 5/2/2026, 10:07:57 AM | succeeded | 1 | 45.1 KB | 2.1 s | cron |
| 5/2/2026, 9:07:57 AM | succeeded | 1 | 50.7 KB | 2.3 s | cron |
| 5/2/2026, 8:07:57 AM | succeeded | 1 | 25.6 KB | 3.4 s | cron |
| 5/2/2026, 7:07:57 AM | succeeded | 1 | 37.9 KB | 6.5 s | cron |
| 5/2/2026, 6:07:57 AM | succeeded | 1 | 13.1 KB | 4.7 s | cron |
| 5/2/2026, 5:07:57 AM | succeeded | 1 | 30.3 KB | 4.6 s | cron |
| 5/2/2026, 4:07:57 AM | succeeded | 1 | 40.0 KB | 4.8 s | cron |
| 5/2/2026, 3:07:57 AM | succeeded | 1 | 34.3 KB | 2.7 s | cron |
| 5/2/2026, 2:07:57 AM | succeeded | 1 | 37.1 KB | 5.2 s | cron |
| 5/2/2026, 1:07:57 AM | succeeded | 1 | 22.5 KB | 3.3 s | cron |
| 5/2/2026, 12:07:57 AM | succeeded | 1 | 34.6 KB | 1.9 s | cron |
| 5/1/2026, 11:07:57 PM | succeeded | 1 | 40.4 KB | 2.3 s | cron |
| 5/1/2026, 10:07:57 PM | succeeded | 1 | 37.7 KB | 5.0 s | cron |
| 5/1/2026, 9:07:57 PM | succeeded | 1 | 20.1 KB | 6.0 s | cron |
| 5/1/2026, 8:07:57 PM | succeeded | 1 | 26.8 KB | 5.7 s | cron |
| 5/1/2026, 7:07:57 PM | succeeded | 1 | 26.7 KB | 5.4 s | cron |
| 5/1/2026, 6:07:57 PM | succeeded | 1 | 30.6 KB | 6.2 s | cron |
| 5/1/2026, 5:07:57 PM | succeeded | 1 | 5.8 KB | 1.6 s | cron |
| 5/1/2026, 4:07:57 PM | succeeded | 1 | 39.3 KB | 3.0 s | cron |
| 5/1/2026, 3:07:57 PM | succeeded | 1 | 45.9 KB | 3.9 s | cron |
| 5/1/2026, 2:07:57 PM | succeeded | 1 | 5.7 KB | 1.9 s | cron |
Recent evidence
Last 25 captured artifacts
| Captured | Filename | Hash | Size | Locked until |
|---|---|---|---|---|
| 5/2/2026, 7:07:57 PM | m365-audit-2026-05-02T19_07_57_367Z.json | 7dc9d7a91913dfa9… | 51.9 KB | 4/30/2033 |
| 5/2/2026, 6:07:57 PM | m365-audit-2026-05-02T18_07_57_367Z.json | f7edeca05b73bf82… | 55.1 KB | 4/30/2033 |
| 5/2/2026, 5:07:57 PM | m365-audit-2026-05-02T17_07_57_367Z.json | 976a64fbd35c7a0d… | 15.9 KB | 4/30/2033 |
| 5/2/2026, 4:07:57 PM | m365-audit-2026-05-02T16_07_57_367Z.json | 08db85451fdc0243… | 23.1 KB | 4/30/2033 |
| 5/2/2026, 3:07:57 PM | m365-audit-2026-05-02T15_07_57_367Z.json | 747e655a52ed6606… | 51.3 KB | 4/30/2033 |
| 5/2/2026, 2:07:57 PM | m365-audit-2026-05-02T14_07_57_367Z.json | 7659740aadf4173a… | 5.0 KB | 4/30/2033 |
| 5/2/2026, 1:07:57 PM | m365-audit-2026-05-02T13_07_57_367Z.json | 3e8a26a8dab46f2e… | 23.6 KB | 4/30/2033 |
| 5/2/2026, 12:07:57 PM | m365-audit-2026-05-02T12_07_57_367Z.json | 2311f6feaa3e23a6… | 46.5 KB | 4/30/2033 |
| 5/2/2026, 11:07:57 AM | m365-audit-2026-05-02T11_07_57_367Z.json | c9801350326f5d48… | 17.4 KB | 4/30/2033 |
| 5/2/2026, 10:07:57 AM | m365-audit-2026-05-02T10_07_57_367Z.json | 2da0a1d9ba93ff34… | 45.1 KB | 4/30/2033 |
| 5/2/2026, 9:07:57 AM | m365-audit-2026-05-02T09_07_57_367Z.json | f10525a72176c83a… | 50.7 KB | 4/30/2033 |
| 5/2/2026, 8:07:57 AM | m365-audit-2026-05-02T08_07_57_367Z.json | 995ba33929b76a2a… | 25.6 KB | 4/30/2033 |
| 5/2/2026, 7:07:57 AM | m365-audit-2026-05-02T07_07_57_367Z.json | 9e7be02109dd0b0c… | 37.9 KB | 4/30/2033 |
| 5/2/2026, 6:07:57 AM | m365-audit-2026-05-02T06_07_57_367Z.json | d76ee1e21ebd958f… | 13.1 KB | 4/30/2033 |
| 5/2/2026, 5:07:57 AM | m365-audit-2026-05-02T05_07_57_367Z.json | cbc50f842a59a981… | 30.3 KB | 4/30/2033 |
| 5/2/2026, 4:07:57 AM | m365-audit-2026-05-02T04_07_57_367Z.json | 107c7c8a00a4ced5… | 40.0 KB | 4/30/2033 |
| 5/2/2026, 3:07:57 AM | m365-audit-2026-05-02T03_07_57_367Z.json | e9e9ab22350feb4b… | 34.3 KB | 4/30/2033 |
| 5/2/2026, 2:07:57 AM | m365-audit-2026-05-02T02_07_57_367Z.json | 0f405e7656bbb050… | 37.1 KB | 4/30/2033 |
| 5/2/2026, 1:07:57 AM | m365-audit-2026-05-02T01_07_57_367Z.json | c1c948654555e2d5… | 22.5 KB | 4/30/2033 |
| 5/2/2026, 12:07:57 AM | m365-audit-2026-05-02T00_07_57_367Z.json | 43164181ca71cb7c… | 34.6 KB | 4/30/2033 |
| 5/1/2026, 11:07:57 PM | m365-audit-2026-05-01T23_07_57_367Z.json | 5f0018c9b5fe6ab4… | 40.4 KB | 4/29/2033 |
| 5/1/2026, 10:07:57 PM | m365-audit-2026-05-01T22_07_57_367Z.json | ed23120661974bfc… | 37.7 KB | 4/29/2033 |
| 5/1/2026, 9:07:57 PM | m365-audit-2026-05-01T21_07_57_367Z.json | 7dd5fd1bc8fdf183… | 20.1 KB | 4/29/2033 |
| 5/1/2026, 8:07:57 PM | m365-audit-2026-05-01T20_07_57_367Z.json | d2f9dd69c48c8816… | 26.8 KB | 4/29/2033 |
| 5/1/2026, 7:07:57 PM | m365-audit-2026-05-01T19_07_57_367Z.json | 42b6a755b245a183… | 26.7 KB | 4/29/2033 |