SharePoint online audit

Question

How to get sharepoint online audit data programatically without using Search-unifiedauditlog commandlet.

Answer 1

You can use the Office 365 Management Activity API instead of using the Search-UnifiedAuditLog cmdlet in a PowerShell script.

https://manage.office.com/api/v1.0/<tenant GUID>/activity/feed/subscriptions/start?contentType=Audit.SharePoint

For more information, see Office 365 Management Activity API reference (https://go.microsoft.com/fwlink/p/?linkid=852309).

Demos about how to use Activity API:

https://www.anupams.net/o365-management-api-automate-sharepoint/

http://www.myfatblog.co.uk/index.php/2017/06/keeping-office-365-audit-data-beyond-90-days-with-the-microsoft-graph/