I am using the Python Graph SDK to try and ingest audit logs for an exchange server. I have managed to pull the logs but I would prefer to narrow down what entries I am getting via the query.

Is it possible to filter on MailboxGUID or MailboxOwner?

I have read through documentation and the python SDK github but haven’t found anything actionable.

My example request:

request_body = AuditLogQuery(
    odata_type="#microsoft.graph.security.auditLogQuery",
    display_name="Exchange Audit Log Query Test",
    filter_start_date_time=(datetime.now() - timedelta(hours=8)).astimezone(),
    filter_end_date_time=(datetime.now()).astimezone(),
    status=AuditLogQueryStatus.NotStarted,
    record_type_filters=[
        AuditLogRecordType.ExchangeItem,
        AuditLogRecordType.ExchangeItemGroup,
    ],
    keyword_filter="audit_data/additional_data.MailboxGuid eq 'XXXXXXXXX-XXXX-XXXXX'"
)

create_query_result = await graph_client_beta.security.audit_log.queries.post(
    body=request_body
)

Would return audit log records with the MailboxGuid equaling ‘XXXXXXXXX-XXXX-XXXXX’.