PowerPlatformAdminActivity

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Reference for PowerPlatformAdminActivity table in Azure Monitor Logs.

Attribute	Value
Category	Audit, Security
Basic Logs Eligible	✓ Yes (source)
Supports Transformations	✓ Yes (source)
Ingestion API Supported	✗ No
Azure Monitor Tables Reference	View Documentation

Schema
Additional Information
Solutions
Connectors
Content Items

Schema (19 columns)

Source: Azure Monitor documentation

Column Name	Type	Description
_BilledSize	real	The record size in bytes
_IsBillable	string	Specifies whether ingesting the data is billable. When _IsBillable isfalseingestion isn't billed to your Azure account
ActorName	string	The UPN (User Principal Name) of the user who performed the action (specified in the Operation property) that resulted in the record being logged; for example, my_name@my_domain_name. Note that records for activity performed by system accounts (such as SHAREPOINT\system or NT AUTHORITY\SYSTEM) are also included. In SharePoint, another value display in the UserId property is app@sharepoint. This indicates that the "user" who performed the activity was an application that has the necessary permissions in SharePoint to perform organization-wide actions (such as search a SharePoint site or OneDrive account) on behalf of a user, admin, or service. For more information, see the app@sharepoint user in audit records.
ActorUserId	string	An alternative ID for the user identified in the UserId property. For example, this property is populated with the passport unique ID (PUID) for events performed by users in SharePoint, OneDrive for Business, and Exchange. This property may also specify the same value as the UserID property for events occurring in other services and events performed by system accounts.
ActorUserType	string	The type of user that performed the operation. For example: Admin, System, Application, Service Principal, Guest or Other.
EnvironmentId	string	The unique identifier of the environment.
EventOriginalType	string	The name of the user or admin activity that performed the activity. For a description of the most common operations/activities, see "Search the audit log" in the Office 365 Protection Center. For Exchange admin activity, this property identifies the name of the cmdlet that was run. For Dlp events, this can be "DlpRuleMatch", "DlpRuleUndo" or "DlpInfo", which are described under "DLP schema" below.
EventOriginalUid	string	Unique identifier of an audit record.
EventResult	string	Indicates whether the action (specified in the Operation property) was successful or not. Possible values are Succeeded, PartiallySucceeded, or Failed.
OrganizationId	string	The GUID for your organization's Office 365 tenant. This value will always be the same for your organization, regardless of the Office 365 service in which it occurs.
Properties	dynamic	Additional information properties with KQL friendly formatting.
PropertyCollection	dynamic	Additional information property bag for the event.
RecordType	string	The type of operation indicated by the record. See the AuditLogRecordType table for details on the types of audit log records.
RequiresCustomerKeyEncryption	bool	Status of the Customer Key Encryption requirement for the event.
SourceSystem	string	The type of agent the event was collected by. For example,OpsManagerfor Windows agent, either direct connect or Operations Manager,Linuxfor all Linux agents, orAzurefor Azure Diagnostics
TenantId	string	The Log Analytics workspace ID
TimeGenerated	datetime	The date and time in (UTC) when the user performed the activity.
Type	string	The name of the table
Workload	string	The Office 365 service where the activity occurred.

Additional Information

📖 Related Documentation: Power Platform administrative logs - View Power Platform administrative logs using auditing solutions

Solutions (1)

This table is used by the following solutions:

Microsoft Business Applications

Connectors (1)

This table is ingested by the following connectors:

Connector	Selection Criteria
Microsoft Power Platform Admin Activity

Content Items Using This Table (8)

Analytic Rules (7)

In solution Microsoft Business Applications:

Analytic Rule	Selection Criteria
Dataverse - Guest user exfiltration following Power Platform defense impairment
Power Apps - App activity from unauthorized geo
Power Apps - Bulk sharing of Power Apps to newly created guest users
Power Apps - Multiple apps deleted
Power Apps - Multiple users access a malicious link after launching new app
Power Platform - Connector added to a sensitive environment
Power Platform - DLP policy updated or removed

Hunting Queries (1)