Advanced filters for Admin audit logs
Use Advanced Filters to limit your Admin audit logs query by:
Admin/application
Target
Activity
and more!
The table below lists the properties that can be used in the filter query.
*For a list of activities and categories, refer to Microsoft Entra audit log categories and activities.
Activity* |
Application Display Name - Initiated by |
Application ID - Initiated by |
Category* |
Correlation ID |
Date (UTC) |
GUID |
Operation type |
Result Status |
Service |
Target Display Name |
Target ID |
Target Type |
Target Username |
User Display Name - Initiated by |
User ID - Initiated by |
Username - Initiated by |
Combine filters with AND/OR operators for even more specific searches. Scroll down to see examples below.
Advanced filters are sticky
The filters you set remain until you change them or if you disable Advanced Filters setting.
This means that if you made a mistake in the filter query and no data was returned, you can adjust filters the next time you load Admin Audit Logs.
Ex. 1 - Get any Group management activity initiated by 2 admins
This example retrieves all events that are in the category ‘GroupManagement’ and that were initiated by either admin A or admin B.
With this logic in mind, here’s how to build it:
First select the ‘Category’ field and set it equal to ‘GroupManagement’.
Next ‘Add group’.
Click on ‘AND’ to set the operator between the groups.
In the new group, select ‘Username - Initiated By’ field and set it equal to the username of the 1st admin.
In the same group, ‘Add rule’ and click on 'OR' within the group.
In the second rule, select ‘Username - Initiated By’ field and set it equal to the username of the 12nd admin.
Once you’re done, review the resulting logical query.
Ex.2 - Get all PIM-related events within a date range
According to the list of Microsoft Entra audit log categories and activities, there are many activities related to PIM.
If you want all PIM related activity, it’s best to use advanced filters for the 4 categories (ApplicationManagement, GroupManagement, ResourceManagement, RoleManagement), and then apply a ‘text contains PIM' filter on the Activity column in the grid.
Since the date range and categories require their own ‘Rule group’, make sure to create the 2 groups first and remove the default non-grouped rule.
Click ‘Add group’ twice.
Delete the first non-grouped entry.
Click ‘AND’ for the relationship between the groups.
In the first group, ‘Add rule’ and set the time range using the calendar and time dials.
Click ‘AND’ within that 1st group.
In the second group, click ‘Add rule’ 3 times.
Set each of these 4 rules on ‘Category’ equals ApplicationManagement, GroupManagement, ResourceManagement, RoleManagement respectively.
Click ‘OR’ within that 2nd group.
