How to Build a Tenant-Wide Change Log Using Audit Logs and Power Automate Secure your Microsoft 365 environment with better visibility. Here’s how to build a tenant-wide change log using Microsoft Purview audit logs and Power Automate. Before we begin, be sure to subscribe to NinjaOne’s IT video hub and our YouTube channel for more tech content like this. Challenges of Tracking M365 Tenant Activity Your Microsoft 365 environment undergoes constant changes, which can make activity tracking difficult without centralized visibility. With Microsoft Purview audit logs and Power Automate, you can transform raw activity data into a centralized and actionable change log. How to Enable Audit Logging and Configure Power Automate Unified Audit Logging via Microsoft Purview To enable Unified Audit Logging, sign in to the Microsoft Purview Compliance Portal using an administrator account. Navigate to Solutions > Audit, and click ‘Start recording user and admin activity’ if auditing is not already enabled. Once enabled, verify that auditing covers services such as Exchange Online, SharePoint and OneDrive, Microsoft Teams, and Microsoft Entra ID. Initial events may appear within one hour, but full audit coverage can take up to 24 hours. This method is ideal when setting up tenant-wide auditing for the first time or validating existing audit coverage. These audit logs will serve as the data source for your Power Automate workflow, helping convert raw audit events into actionable records. Power Automate To activate Power Automate, first create a Microsoft Entra ID app registration by navigating to Azure Portal > Microsoft Entra ID > App registrations > New registration. Grant the following API permissions: AuditLog.Read.All for Microsoft Graph ActivityFeed.Read for Office 365 Management APIs Then, head to Power Automate, click Create, and select Scheduled cloud flow. Give the flow a name, configure it to run every hour, then click Create. Next, click Search, and select Microsoft Entra ID > Get OAuth 2.0 Token. Fill in the following authentication details for your app registration: Afterwards, click + New step, search for HTTP, and configure the HTTP action using the Microsoft Graph audit log endpoint shown on screen. Configure the following: Then, filter new events by clicking + New step and searching for Filter array. In the From field, select the value output from the HTTP step, then paste the filter expression shown on screen: Add one final step, then search SharePoint > Add item to list. Select the site, and map the following fields: This will save the data to your logs. Test if it works, activate it, and confirm the events that appear in your log destination. These are just two methods that can greatly help admins audit and monitor activity across vast environments. Users can also explore other methods, which are explained in detail in the corresponding blog for this video. For more information, check out our official blog post on How to Build Tenant-Wide Change Logs with Power Automate Audit Logs, linked in the description below.