How to Build a Tenant-Wide Change Log Using Audit Logs and Power Automate

Keeping track of rapid changes across your Microsoft 365 tenant, like user modifications, security updates, or role assignments, can feel impossible without centralized visibility.

A solution to this is to use Power Automate for the audit logs, turning them into a clear, actionable record for accountability and security. In this guide, you’ll learn how to build this using Power Automate and Microsoft Purview, step by step.

Procedures for building a tenant change log

Centralizing change tracking prevents security gaps and simplifies compliance audits across your Microsoft 365 environment.

📌 Use case: An automated tenant change log helps you monitor critical activities like permission changes, policy updates, user lifecycle events, and maintain historical visibility across departments. It turns scattered Microsoft Purview audit logs into a unified security asset.

📌 Prerequisites: Before proceeding, make sure you have Microsoft 365 E3/E5, Power Automate access, an administrator role in the environment (e.g., Global Admin, Security Admin, or Compliance Admin), access to Microsoft Purview Compliance Portal, and PowerShell modules (specifically Microsoft Graph and ExchangeOnlineManagement).

We recommend checking ⚠️Things to look out for before proceeding.

📌 Deployment strategies:

Method 1: Enable Unified Audit Logging

Activating unified auditing ensures Microsoft 365 records every critical change across your tenant.

📌 Use case: This is the ideal procedure when setting up your tenant change log for the first time or verifying existing audit coverage..

Step-by-step procedure:

1. Access Purview Portal.
   • Go to Microsoft Purview Compliance Portal, then sign in with your admin account.
2. Navigate to Audit.
   • In the left menu, select Solutions > Audit.
   • If you can’t find it, click View all solutions first.
3. Enable logging.
   • If auditing is disabled, you’ll see a prominent banner; then, click Start recording user and admin activity.

💡 Note: If no banner appears, auditing is already enabled.

4. Verify coverage.
   • Confirm these services are included:
     1. Exchange Online
     2. SharePoint/OneDrive
     3. Microsoft Teams
     4. Microsoft Entra ID
5. Wait for activation.
   • Give the system 24 hours for full log generation. Initial events appear within one hour.

Within 24 hours, Microsoft 365 will begin recording events, such as user creations, permission changes, and policy updates. These Microsoft Purview audit logs become the data source for your Power Automate workflow.

Method 2: Use Power Automate to log changes from audit events

Automate tenant-wide tracking by transforming raw audit data into actionable records.

📌 Use case: Do this when you need continuous, customized logging of specific changes like permission updates or mailbox modifications..

Step-by-step procedure:

1. Create an Azure AD App registration.
   • Go to the Azure Portal > Entra ID > App registrations > New registration.
   • Grant these API permissions:
     1. AuditLog.Read.All (for Microsoft Graph)
     2. ActivityFeed.Read (Office 365 Management APIs)
2. Create a new flow.
   • Go to Power Automate, then click Create, choose Scheduled cloud flow.
   • Name it (e.g., Tenant Change Logger).
   • Set to run every one hour (default setting), then click Create.
3. Get your security token.
   • Add a new action:
     • Click Search, then select Azure AD > Get OAuth 2.0 Token.
     • Fill in:
       1. Authority URL: https://login.microsoftonline.com
       2. Client ID: [From your Azure AD app]
       3. Client Secret: [From your Azure AD app]
       4. Resource: https://graph.microsoft.com
4. Add the Audit Log Fetcher.
   • Click + New step, then search for HTTP and select HTTP-HTTP.
   • Configure:
     1. Method: GET
     2. URI: Paste https://graph.microsoft.com/v1.0/auditLogs/directoryAudits
     3. Headers:

{
“Authorization”: “Bearer <PASTE_TOKEN_HERE>”
}

5. Filter important events.
   • Click + New step, then search Filter array.
   • In From, select value from the HTTP step.
   • Paste this in the filter box:

@or(
equals(item()?[‘activityDisplayName’], ‘Add member to role’),
equals(item()?[‘activityDisplayName’], ‘Delete user’)
)

• • This catches only role/permission changes – customize your watchlist here.

6. Save to your log.
   • Add final action, then search SharePoint > Add item to list.
   • Select your site/list.
   • Map fields:
     1. Timestamp: activityDateTime
     2. User: userPrincipalName
     3. Action: activityDisplayName
7. Test and activate.
   • Run manually with the Test button.
   • Confirm events appear in your log destination.

Your flow will automatically populate your automated change log hourly with events like user deletions or policy updates. You’ll now have a searchable, centralized record for audits or incident investigations.

Method 3: Use PowerShell to export and store audit logs

PowerShell delivers precision control for extracting and storing critical change records.

📌 Use case: Use this method when you need deep filtering, custom scheduling, or direct CSV exports for historical analysis.

Step-by-step procedure:

1. Connect to Exchange Online.
   • Open Windows Terminal (Admin), then run:

Connect-ExchangeOnline -Device
# Authenticate with your admin account when prompted

2. Search and export logs.
   • Run this command to capture key events:

Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-1) -EndDate (Get-Date) `-Operations “Add-MailboxPermission”, “Update-User”, “Add-MemberToRole” `-ResultSize 1000 | Export-Csv “C:\AuditLogs\Changes.csv” -NoTypeInformation

3. Automate daily exports.
   • Save the script as Export-AuditLogs.ps1.
   • Create a Windows Task Scheduler job or use your RMM platform (e.g., NinjaOne) to deploy this script to your enterprise devices:
     1. Trigger: Daily at 2 AM (or whenever is best in your workplace).
     2. Action:  powershell.exe -File “C:\Scripts\Export-AuditLogs.ps1”

Your scheduled task will generate daily CSV files (e.g., Changes_08-15-2023.csv) containing timestamped records of admin actions, ready for Excel analysis (use Power Query to parse JSON fields), long-term storage (Azure Blob/network shares), and manual audits or SIEM ingestion.

Method 4: Store logs in a centralized SharePoint or Teams location

Store your change history where teams can securely access and collaborate.

📌 Use case: Ideal for teams needing shared, searchable audit trails with customizable permissions.

Step-by-step procedure:

1. Create a SharePoint Log location.
   • Go to SharePoint Online > + New > List.
   • Name: TenantChangeLog.
   • Create these columns:

2. Auto-populate with Power Automate.
   • Modify your existing Power Automate flow (from Method 2):
     • Replace the final action with: SharePoint > Add item to list.
     • Map fields:
       1. Timestamp: activityDateTime
       2. User: userPrincipalName
       3. Operation: activityDisplayName
       4. Workload: service
       5. Item: targetResources
3. Set permissions.
   • In SharePoint:
     1. Go to Settings > List permissions.
     2. Grant Read access to auditors.
     3. Restrict Edit to security admins.

Your automated change log will update hourly with new events. Team members can now search historical changes in SharePoint/Teams, set alerts on critical operations (e.g., “Add member to role”), and build Power BI dashboards from the list.

Method 5: Use Registry to tag endpoint events or attach device metadata

Add endpoint context to your audit trails for precise incident tracing.

📌 Use case: Use this when you need to trace actions to specific devices or departments during security investigations.

Step-by-step procedure:

1. Create the Registry keys.
   • Open Run (Win + R), then type regedit to open the Registry Editor.
     • Make sure you have administrative privileges.
   • Go to HKEY_LOCAL_MACHINE\SOFTWARE\Org\TenantMetadata
     • If the TenantMetadata key is missing, create it (Right-click > New > Key).
   • Add two String Values (Right-click inside the key > New > String).
     • Name one String as DeviceTag.
       1. Input its Value as NYC-Laptop-001.
     • Name the other String as Department.
       • Input its Value as Finance.
2. Automate tag deployment (Group Policy).
   • Open Group Policy Management Console.
   • Create a new GPO in Computer Configuration > Preferences > Registry:
     • Input the following:
       1. Action: Create
       2. Hive: HKEY_LOCAL_MACHINE
       3. Key Path: SOFTWARE\Org\TenantMetadata
       4. Value: DeviceTag, then set Type to REG_SZ and Data to “%COMPUTERNAME%”
3. Enrich audit logs:
   • Using PowerShell, append to export the script below:

• • Power Automate: Add an HTTP action to the device management API to fetch tags during log processing.

Method 6: Apply Group Policy for event auditing on endpoints

Extend your visibility to on-premises devices for comprehensive hybrid monitoring.

📌 Use case: Ideal for organizations with Windows 11 devices in hybrid Azure AD environments needing local activity tracking.

Step-by-step procedure:

1. Open Group Policy Management.
   • Press Win + R, then type gpmc.msc to open the tool.
   • Go to Forest > Domains > [Your Domain].
2. Create a new policy.
   • Right-click Group Policy Objects, then select New.
   • Name it as Endpoint-Audit-Policy.
3. Configure Audit settings.
   • Go to Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies.
   • Enable the following:
     1. Account Management: Audit User Account Management (Success)
     2. Account Management: Audit Security Group Management (Success)
     3. Logon/Logoff: Audit Logon (Success, Failure).
4. Link to organizational unit.
   • Right-click your target OU (e.g., Hybrid-Workstations).
   • Select Link an Existing GPO, then choose Endpoint-Audit-Policy.

Windows 11 devices will begin logging specified events to their local Security event log. You can now correlate events to match local logons with Entra ID sign-ins, forward logs using Azure Monitor to ingest into Sentinel/Purview, and enrich cloud logs by adding device context via Method 5’s registry tags.

Method 7: Use CMD and CLI for validation and log diagnostics

Command-line diagnostics offer quick validation for your logging infrastructure.

📌 Use case: Ideal for troubleshooting missing events, testing connectivity, or verifying log contents during deployments.

Step-by-step procedure:

1. Verify audit policies.
   • Open Command Prompt (Admin) by searching for it in the taskbar.
   • Run this command: auditpol /get /category:*
   • Look for Account Management and Logon categories to confirm Method 6’s GPO is applied.
2. Check local security events.
   • Run this command:

wevtutil qe Security “/q:*[System[(EventID=4720 or EventID=4625)]]” /f:text /c:5

3. Test cloud connectivity.
   • Run this command:

nslookup graph.microsoft.com && ping manage.office.com

• • Confirm DNS resolution for Power Automate/PowerShell log fetches.

4. Inspect exported logs.
   • Run this command:

type “C:\Logs\TenantChangeLog.csv” | findstr “Add member”

• • This searches for permission changes in PowerShell exports.

After running these diagnostics, you’ll confirm GPO/registry changes are active, identify missing events or connectivity blockers, and adjust Power Automate flows or scripts as needed.

⚠️ Things to look out for

This section highlights potential challenges to keep in mind while following this guide.

Key considerations when building a tenant change log

Plan strategically to ensure your solution scales securely and cost-effectively.

Retention policies

Microsoft 365’s audit logs have strict retention windows:

• E3 licenses: 90 days (default)
• E5/Audit Premium: 180 days to 10 years (with add-ons)

Make sure to automate weekly exports to Azure Blob Storage or SharePoint for long-term archival.

Cost management

Power Automate flows are free for 5,000 monthly actions or fewer, but premium connectors cost extra, listing at $15 per user per month, according to Microsoft’s price list for Power Automate.

Microsoft Purview Audit Premium is also included with Microsoft 365 E5 or the Microsoft 365 E5 Compliance add‑on, listed at $12/user/month, and provides 1‑year default audit‑log retention with options up to 10 years, according to Microsoft Learn as of July 11, 2025.

💡 Tip: Filter high-value events early to reduce volume.

Export limits

API throttling can hold up to 2,000 requests per 10 minutes for each tenant. Meanwhile, Record caps can do 5,000 entries per PowerShell/API call. You can use pagination (@odata.nextLink) and chunked searches:

Search-UnifiedAuditLog -StartDate $start -EndDate $end -SessionCommand ReturnLargeSet

Multi-Tenant Delegation (MSPs)

Leverage Azure Lighthouse to centralize log collection without switching contexts to onboard customer tenants via ARM templates, use a single dashboard to query all tenant change logs, and restrict access with RBAC roles.

How can NinjaOne make audit logging much easier?

Unify and automate tenant-wide change tracking across cloud and endpoints.

1. Automated script deployment: Schedule PowerShell scripts across Windows 11 devices to centralize audit logs from Microsoft 365, Entra ID, and local systems into NinjaOne’s repository.
2. Real-time alerts and ticketing: Trigger notifications and auto-create tickets for critical events:
   • Privilege escalations
   • Sensitive mailbox access
   • User deletions
3. Unified log correlation: Blend tenant change logs with endpoint events to detect anomalies like admin logins from new devices and policy changes during off-hours
4. Multi-tenant compliance dashboard: For MSPs: Visualize all client automated change logs in one glass pane, filter by severity/workload, and generate audit-ready reports.

Power Automate audit logs: Achieve strong compliance

Centralizing your tenant change log transforms scattered events into actionable security intelligence, ensuring audit readiness and real-time threat detection.

Now deploy these techniques to instantly trace breaches like privilege escalations, prove compliance during audits without frantic scrambling, and sleep knowing every critical change is tracked.

Related topics

• Complete Guide: How to Read Windows Update Logs
• How to Read Windows Update Logs – A Guide
• What Is an IT Audit? A How-To Guide
• Advance Automations with NinjaOne