Configuring REST API

How to use Office 365 Management Activity API to fetch SharePoint Online audit logs

Builds 4500 and lower use the Search-UnifiedAuditLog script to fetch SharePoint Online audit logs. Using this PowerShell script has sometimes caused data inconsistencies for a few users. Starting with build 4501, users can choose to use the Office 365 Management Activity API instead to avoid missing any data. Follow the steps below to use this API to fetch the audit data.

1. If the Azure application is not configured,
   1. Create Azure application manually and update them on the product's Admin page.
   2. Save the configuration.
2. If the Azure application is already configured, follow the steps below:
   1. Ensure you're running the latest version of SharePoint Manager Plus to get the Client ID from the UI. Navigate to the Admin tab > Microsoft 365 and copy the Client ID under the Azure Application column for your respective tenant.
   
   • Select farm_id, client_id from AzureAppCredentials;
   2. Open the Azure portal and navigate to Microsoft Entra ID → App Registrations → All applications.
   3. Search with your Client ID and open the application.
   4. Open API permissions and click Add a permission.
   5. In the pop-up, navigate to Office 365 Management APIs → Application permissions.
   6. Select ActivityFeed.Read and click Add permissions.
   7. Click on Grant admin consent for <Your Company> and give confirmation.
   
   8. Contact support to get the files required to connect to the database and store them in the <product-installation-directory>/bin folder. Open connectDB.bat from <product-installation-directory>/bin and run the following query to update the audit type
      • update onlineprofiles set audit_type=4;
   9. Restart SharePoint Manager Plus to apply the changes.