I am currently using Graph SDK v5.56 in C# to retrieve AuditLog data from Microsoft Purview. In Graph Explorer, I was able to successfully retrieve the data by calling the following endpoint:
https://graph.microsoft.com/beta/security/auditLog/queries
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#security/auditLog/queries",
"@odata.count": 12,
"@microsoft.graph.tips": "Use $select to choose only the properties your app needs, as this can lead to performance improvements. For example: GET security/auditLog/queries?$select=administrativeUnitIdFilters,displayName",
"value": [
{
"id": "guid",
"displayName": "AuditLog_CreatedByGraph2",
"filterStartDateTime": "2024-07-01T00:00:00Z",
"filterEndDateTime": "2024-08-09T00:00:00Z",
"recordTypeFilters": [],
"keywordFilter": "",
"serviceFilters": [],
"operationFilters": [
"filesensitivitylabelapplied"
],
"userPrincipalNameFilters": [],
"ipAddressFilters": [],
"objectIdFilters": [],
"administrativeUnitIdFilters": [],
"status": "succeeded"
}
...
]
}
However, when trying to achieve the same result using the Graph SDK, I noticed that graphServiceClient.Security.AuditLog.Queries doesn’t seem to exist (there is no AuditLog property after Security). I tried using the following approach to fetch the AuditLog queries:
var result = graphServiceClient.Security.WithUrl("https://graph.microsoft.com/beta/security/auditLog/queries")
.GetAsync()
.GetAwaiter()
.GetResult();
But this approach returned 0 results.
How can I retrieve the same results using the Graph SDK in C# as I do with the Graph Explorer? Any guidance would be appreciated!