Microsoft 365 Audit General and DLP

About

This solution provides two codeless connectors (CCP) that ingest Microsoft 365 audit logs from the Office 365 Management Activity API into a shared 321-column custom table (M365AuditGeneral_CL) in Microsoft Sentinel.

• Audit.General — 29 specialty workloads: Copilot & AI, Power BI, Viva suite, Security & Compliance, eDiscovery, Defender for Office 365, Attack Simulation, Microsoft Sentinel platform, and more
• Audit.DLP — Data loss prevention (DLP) events in Microsoft Purview available for Exchange Online, Endpoint (devices), and SharePoint and OneDrive

Events from workloads that have dedicated Sentinel connectors (Teams, Exchange, SharePoint, Entra ID, Dynamics 365, Purview Information Protection) are filtered out to avoid duplication.

Support

This is a partner-supported solution. For bug reports, feature requests, or questions, please open an issue on GitHub.

Resources