Actions129
- Calendar Permission Actions
- CIPP Administration Actions
- Execute API Client (GET)
- Execute Auto Backup
- Execute Extension Mapping (GET)
- Execute Extension Mapping (POST)
- Execute Extension Sync
- Execute Extensions Config
- Execute Password Config (POST)
- Execute Restore Backup
- Execute Run Backup
- List Custom Roles
- List Extension Sync
- List Logs
- List Scheduled Items
- Remove Scheduled Item
- Execute API Client (POST)
- Execute Extension Test
- Execute Password Config (GET)
- List Backups
- List Function Parameters
- Group Actions
- Intune Actions
- Add MSP App
- Add Office App
- Add Policy
- Add Store App
- Assign App
- Assign Autopilot Device
- Device Action
- Get Recovery Key
- List Applications
- List Application Queue
- List Autopilot Config
- List Devices
- List Intune Scripts
- List Intune Templates
- Remove Autopilot Device
- Remove Policy
- Remove Queued App
- Add Choco App
- Add WinGet App
- Assign Policy
- Get Local Admin Password
- List Autopilot Devices
- List Intune Policies
- Remove App
- Remove Intune Script
- Sync Autopilot Devices
- License Actions
- Security & Compliance Actions
- Teams & SharePoint Actions
- Tenant Actions
- Add Alert
- Clear Tenant Cache
- Execute CA Exclusion
- Execute Named Location
- Get Tenant
- List Alerts Queue
- List Azure AD Connect Status
- List Conditional Access Policies
- List Named Locations
- List Shared Mailbox Statistics
- List Standards
- List Tenants
- Remove Standard Template
- Add Named Location
- Edit Tenant
- Execute Standards Run
- List Audit Logs
- List CSP Licenses
- List Roles
- List Standard Templates
- Tool Actions
- User Actions
- Add User
- Exec Restore Deleted User
- List User
- List User Conditional Access Policies
- List User Groups
- Clear Immutable ID
- Create Temporary Access Password
- Delete User Device
- Dismiss Risky User
- List Deleted Items
- List Inactive Accounts
- List Sign-Ins
- Remove User
- Reset MFA
- Restore Deleted Item
- Revoke Sessions
- Set Email Forward
- Set Per-User MFA
- List All Users
- List User Counts
- List User Devices
- Convert Mailbox
- Disable User
- Enable Archive
- List MFA Users
- Offboard User
- Reset Password
- Send MFA Push
- Set Out of Office
Overview
This node interacts with the CIPP API to list audit logs for a specified tenant. It is useful for administrators or security professionals who need to monitor and review audit logs related to tenant activities. For example, it can be used to track changes, access events, or security incidents within a tenant environment.
Use Case Examples
- Listing audit logs for a tenant to monitor security events.
- Retrieving audit logs to investigate changes made in the tenant environment.
Properties
| Name | Meaning |
|---|---|
| Tenant Filter | Specifies the tenant ID or domain name to filter the audit logs for the desired tenant. |
| Request Options | Additional request settings such as batching, SSL certificate validation, proxy configuration, and request timeout. |
Output
JSON
auditLogs- Array of audit log entries retrieved for the specified tenant.
Dependencies
- Requires an API key credential for authenticating with the CIPP API.
Troubleshooting
- Ensure the tenant filter is correctly specified as a valid tenant ID or domain name; incorrect values may result in no data or errors.
- If SSL certificate validation fails and the 'Ignore SSL Issues' option is not enabled, requests may be blocked; enable this option only if you trust the source.
- Proxy settings must be correctly configured if used; incorrect proxy details can cause request failures.
- Timeout settings should be adjusted based on network conditions; too short a timeout may cause premature request termination.