DataverseActivity

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index

Reference for DataverseActivity table in Azure Monitor Logs.

Attribute	Value
Category	Audit, Security
Basic Logs Eligible	✓ Yes (source)
Supports Transformations	✓ Yes (source)
Ingestion API Supported	✗ No
Lake-Only Ingestion	✓ Yes (source)
Azure Monitor Tables Reference	View Documentation

Schema
Schema References
Additional Information
Solutions
Connectors
Content Items

Schema (32 columns)

Source: Azure Monitor documentation

Column Name	Type	Description
_BilledSize	real	The record size in bytes
_IsBillable	string	Specifies whether ingesting the data is billable. When _IsBillable isfalseingestion isn't billed to your Azure account
ClientIp	string	The IP address of the device that was used when the activity was logged.
CorrelationId	string	A unique value used to associate related rows.
CrmOrganizationUniqueName	string	Unique name of the organization.
EntityId	string	Unique identifier of the entity.
EntityName	string	Name of the entity in the organization.
Fields	dynamic	JSON of Key Value pair reflecting the values that were created or updated.
InstanceUrl	string	URL to the instance.
ItemType	string	The type of object that was accessed or modified. See the ItemType table for details on the types of objects.
ItemUrl	string	URL to the record emitting the log.
Message	string	Name of the message called in the Dynamics 365 SDK.
Operation	string	The name of the operation that the user is performing.
OrganizationId	string	The GUID for your organization's Office 365 tenant. This value will always be the same for your organization.
OriginalObjectId	string	The ObjectId for Dataverse operation or business activity.
Query	string	The query filter parameters used while executing the FetchXML.
QueryResults	dynamic	One or multiple unique records returned by the Retrieve and Retrieve Multiple SDK message call.
ResultStatus	string	Indicates whether the action (specified in the Operation property) was successful or not.
ServiceContextId	string	The unique id associated with service context.
ServiceContextIdType	string	Application defined token to define context use.
ServiceName	string	Name of the Service generating the log.
SourceRecordId	string	Unique identifier of an audit record.
SourceSystem	string	The type of agent the event was collected by. For example,OpsManagerfor Windows agent, either direct connect or Operations Manager,Linuxfor all Linux agents, orAzurefor Azure Diagnostics
SystemUserId	string	Unique identifier of the user GUID in the organization.
TenantId	string	The Log Analytics workspace ID
TimeGenerated	datetime	The date and time in (UTC) when the user performed the activity.
Type	string	The name of the table
UserAgent	string	The user agent.
UserId	string	The Dataverse user ID of the user who performed the action (specified in the Operation property) that resulted in the record being logged.
UserKey	string	An alternative ID for the user identified in the UserId property.
UserType	string	The type of user that performed the operation. See the UserType table in Office 365 management activity api schema documentation for details on the types of users.
UserUpn	string	The UPN (User Principal Name) of the user who performed the action (specified in the Operation property) that resulted in the record being logged.

Schema References

Official Microsoft Learn documentation for field/column information:

DataverseActivity Schema Reference (Azure Monitor)

Additional Information

📖 Related Documentation: Microsoft Dataverse activity logging - Enable and configure Dataverse auditing

Solutions (1)

This table is used by the following solutions:

Microsoft Business Applications

Connectors (1)

This table is ingested by the following connectors:

Connector	Selection Criteria
Microsoft Dataverse

Content Items Using This Table (38)

Analytic Rules (30)

In solution Microsoft Business Applications:

Analytic Rule	Selection Criteria
Dataverse - Anomalous application user activity
Dataverse - Audit log data deletion	`Message in "DeleteAuditData,DeleteRecordChangeHistory"`
Dataverse - Audit logging disabled	`Message in "Update,UpdateAuditSettings"`
Dataverse - Bulk record ownership re-assignment or sharing	`Message in "Assign,GrantAccess,ModifyAccess"`
Dataverse - Export activity from terminated or notified employee
Dataverse - Hierarchy security manipulation
Dataverse - Honeypot instance activity	`Message == "UserSignIn"`
Dataverse - Login by a sensitive privileged user
Dataverse - Login from IP in the block list	`Message == "UserSignIn"`
Dataverse - Login from IP not in the allow list
Dataverse - Malware found in SharePoint document management site
Dataverse - Mass deletion of records	`Message == "BulkDelete"`
Dataverse - Mass export of records to Excel
Dataverse - Mass record updates	`Message == "Update"`
Dataverse - New Dataverse application user activity type
Dataverse - New non-interactive identity granted access
Dataverse - New sign-in from an unauthorized domain	`Message == "UserSignIn"`
Dataverse - New user agent type that was not used before	`UserAgent has_any "Gecko"`
Dataverse - New user agent type that was not used with Office 365
Dataverse - Organization settings modified	`EntityName == "organization"` `Message == "Update"`
Dataverse - Removal of blocked file extensions	`EntityName == "organization"` `Message == "Update"`
Dataverse - SharePoint document management site added or updated	`EntityName == "sharepointsite"` `Message in "Create,Update"`
Dataverse - Suspicious security role modifications
Dataverse - Suspicious use of TDS endpoint	`Message == "ExecutePowerBISql"`
Dataverse - Suspicious use of Web API	`Message == "UserSignIn"`
Dataverse - TI map IP to DataverseActivity
Dataverse - TI map URL to DataverseActivity	`Fields has "http"` `Message in "Create,Update"`
Dataverse - Terminated employee exfiltration to USB drive
Dataverse - Unusual sign-in following disabled IP address-based cookie binding protection
Dataverse - User bulk retrieval outside normal activity	`Message == "RetrieveMultiple"`

Hunting Queries (7)

In solution Microsoft Business Applications:

Hunting Query	Selection Criteria
Dataverse - Activity after Microsoft Entra alerts
Dataverse - Activity after failed logons
Dataverse - Cross-environment data export activity
Dataverse - Dataverse export copied to USB devices
Dataverse - Generic client app used to access production environments
Dataverse - Identity management activity outside of privileged directory role membership
Dataverse - Identity management changes without MFA

Workbooks (1)

In solution Microsoft Business Applications: Message in "Delete,SendEmail"
Message contains "ExportToExcel"
Message contains "Retrieve"
OriginalObjectId startswith "GrantAccess"

Workbook
Dynamics365Activity

Selection Criteria Summary (13 criteria, 17 total references)

References by type: 0 connectors, 17 content items, 0 ASIM parsers, 0 other parsers.

Selection Criteria	Connectors	Content Items	ASIM Parsers	Other Parsers	Total
`Message == "UserSignIn"`	-	4	-	-	4
`EntityName == "organization"` `Message == "Update"`	-	2	-	-	2
`Message in "DeleteAuditData,DeleteRecordChangeHistory"`	-	1	-	-	1
`Message in "Update,UpdateAuditSettings"`	-	1	-	-	1
`Message in "Assign,GrantAccess,ModifyAccess"`	-	1	-	-	1
`Message == "BulkDelete"`	-	1	-	-	1
`Message == "Update"`	-	1	-	-	1
`UserAgent has_any "Gecko"`	-	1	-	-	1
`EntityName == "sharepointsite"` `Message in "Create,Update"`	-	1	-	-	1
`Message == "ExecutePowerBISql"`	-	1	-	-	1
`Fields has "http"` `Message in "Create,Update"`	-	1	-	-	1
`Message == "RetrieveMultiple"`	-	1	-	-	1
`Message in "Delete,SendEmail"` `Message contains "ExportToExcel"` `Message contains "Retrieve"` `OriginalObjectId startswith "GrantAccess"`	-	1	-	-	1
Total	0	17	0	0	17

EntityName

Value	Connectors	Content Items	ASIM Parsers	Other Parsers	Total
`organization`	-	2	-	-	2
`sharepointsite`	-	1	-	-	1

Fields

Value	Connectors	Content Items	ASIM Parsers	Other Parsers	Total
`has http`	-	1	-	-	1

Message

Value	Connectors	Content Items	ASIM Parsers	Other Parsers	Total
`Update`	-	6	-	-	6
`UserSignIn`	-	4	-	-	4
`Create`	-	2	-	-	2
`DeleteAuditData`	-	1	-	-	1
`DeleteRecordChangeHistory`	-	1	-	-	1
`UpdateAuditSettings`	-	1	-	-	1
`Assign`	-	1	-	-	1
`GrantAccess`	-	1	-	-	1
`ModifyAccess`	-	1	-	-	1
`BulkDelete`	-	1	-	-	1
`ExecutePowerBISql`	-	1	-	-	1
`RetrieveMultiple`	-	1	-	-	1
`Delete`	-	1	-	-	1
`SendEmail`	-	1	-	-	1
`contains ExportToExcel`	-	1	-	-	1
`contains Retrieve`	-	1	-	-	1

OriginalObjectId

Value	Connectors	Content Items	ASIM Parsers	Other Parsers	Total
`startswith GrantAccess`	-	1	-	-	1

UserAgent

Value	Connectors	Content Items	ASIM Parsers	Other Parsers	Total
`has_any Gecko`	-	1	-	-	1