DataverseActivity

Contains Microsoft Dataverse audit logs. It's typically used to track Dataverse and Dynamics 365 activities.

Table attributes

Attribute	Value
Resource types	-
Categories	Security, Audit
Solutions	SecurityInsights
Basic log	No
Ingestion-time transformation	Yes
Sample Queries	Yes

Columns

Column	Type	Description
_BilledSize	real	The record size in bytes
ClientIp	string	The IP address of the device that was used when the activity was logged.
CorrelationId	string	A unique value used to associate related rows.
CrmOrganizationUniqueName	string	Unique name of the organization.
EntityId	string	Unique identifier of the entity.
EntityName	string	Name of the entity in the organization.
Fields	dynamic	JSON of Key Value pair reflecting the values that were created or updated.
InstanceUrl	string	URL to the instance.
_IsBillable	string	Specifies whether ingesting the data is billable. When _IsBillable is false ingestion isn't billed to your Azure account
ItemType	string	The type of object that was accessed or modified. See the ItemType table for details on the types of objects.
ItemUrl	string	URL to the record emitting the log.
Message	string	Name of the message called in the Dynamics 365 SDK.
Operation	string	The name of the operation that the user is performing.
OrganizationId	string	The GUID for your organization's Office 365 tenant. This value will always be the same for your organization.
OriginalObjectId	string	The ObjectId for Dataverse operation or business activity.
Query	string	The query filter parameters used while executing the FetchXML.
QueryResults	dynamic	One or multiple unique records returned by the Retrieve and Retrieve Multiple SDK message call.
ResultStatus	string	Indicates whether the action (specified in the Operation property) was successful or not.
ServiceContextId	string	The unique id associated with service context.
ServiceContextIdType	string	Application defined token to define context use.
ServiceName	string	Name of the Service generating the log.
SourceRecordId	string	Unique identifier of an audit record.
SourceSystem	string	The type of agent the event was collected by. For example, OpsManager for Windows agent, either direct connect or Operations Manager, Linux for all Linux agents, or Azure for Azure Diagnostics
SystemUserId	string	Unique identifier of the user GUID in the organization.
TenantId	string	The Log Analytics workspace ID
TimeGenerated	datetime	The date and time in (UTC) when the user performed the activity.
Type	string	The name of the table
UserAgent	string	The user agent.
UserId	string	The Dataverse user ID of the user who performed the action (specified in the Operation property) that resulted in the record being logged.
UserKey	string	An alternative ID for the user identified in the UserId property.
UserType	string	The type of user that performed the operation. See the UserType table in Office 365 management activity api schema documentation for details on the types of users.
UserUpn	string	The UPN (User Principal Name) of the user who performed the action (specified in the Operation property) that resulted in the record being logged.