security/auditLog query returns incomplete results for sharePointFileOperation

Question

Trying to replace Search-UnifiedAuditLog cmdlet vie Graph API. In principle it works great but I noticed that when searching sharePointFileOperation audit events, the results are incomplete. No error, the search completes ok, results are downloaded, it appears ok at first sight, but some percentage of events is simply not there. I verified this by actually accessing the files under another account and checking the results several days later.

Can I be doing something wrong or is this due to the endpoint being beta?

Currently it is unusable even for testing.

Answer 1

Hi DAVID KOSIK,

Currently, GET /security/auditLog/queries APIs available only in beta. The beta endpoint includes APIs that are currently in preview and aren't yet generally available.

Microsoft Graph beta endpoint is a preview version of the API that allows you to test and experiment with new features before they're released to the general public. Try these APIs and provide your feedback. We strongly recommend that developers use the v1.0 endpoint when building production apps.

For details about changes to Microsoft Graph APIs in beta, explore the API changelog.

Hope this helps.

If the answer is helpful, please click Accept Answer and kindly upvote. If you have any further questions about this answer, please click Comment.