Use these search tokens below to search in the Events tab under Monitor.
Use quotes or backticks within values to help
you find all events that have the specified name.
Search for events by specifying the name. Choose values from: UserLoggedIn,
Update application, Set domain authentication, Set federation settings
on domain, Update application - Certificates and secrets management,
Update service Prinicpal, Add service principal credentials, Add app
role assignment grant to user, Add app role assignment to service
principal, Consent to application, UserLoggedIn/UserLoginFailed, MailboxLogin,
MailItemAccessed, FileAccessed, FileAccessedExtended
Show events that have name as UserLoggedIn
Search the connector by providing the unique id provided to identify
Show the connector having the id 100
Search for connectors by specifying the connector type. Choose
value from: OFFICE365, GOOGLE WORKSPACE, SALESFORCE
Show all connectors of the type OFFICE365
Search for events by specifying the event type. Choose value from:
SettingsChange, PermissionChange, SAMLTokenAnomaly, PowershellMailboxLogin,
AADPowershellLogin, AADExchangeOnlinePowershellLogin, WinRMLogin,
Show all events of the type PermissionChange
Search for events based on the event category. Choose value from:
Domain; Application, ServicePrincipal, SAMLToken, User, Powershell;
Mailbox, WinRM, File
Show all events of the category ServicePrincipal
Search for events based on the type of the service. Choose value
from: AzureActiveDirectory, ExchangeOnline, OneDrive
Show all events of the service type AzureActiveDirectory
Search for events based on the actionDetail.result. Choose value
from: Success, Fail
Show all events of the results Success
Search for events that have a specific actor ID.
Show all events that have actor ID 98e0c33e-7acc-46d3-82ba-dd313ef4434f
Search for events by specifying the actor's email addresses.
Show all events attended by user having email address email@example.com
Search for events based on the type of actor. Choose value from:
User, ServicePrincipal, Application
Show all events of the actor type User
Search for events that have a specific origin IP.
Show all events that have origin IP 220.127.116.11
Search for events that have a specific origin user agents.
Show all events that have origin user agents as EvoSTS
Search for events that have a specific resource ID.
Show all events that have resource ID as 05e394a6-3d79-483b-abf2-5f39c5787196
Search for events that have a specific resource name.
Show all events that have resource name as Microsoft Graph