Get auditlogs for a specific user through object id or principal name

Question

I am trying tofind who issued a guest user from a given object id.

As far as I know this can only be found through audit logs. However I cannot seem to find auditlogs from a given user only. I tried:

var directoryAudits = await graphClient.AuditLogs.DirectoryAudits.Request().Filter($"targetResources/any(c:c/id eq '{id}'").GetAsync();

But I get an bad request exception. Any pointers to get audit logs for a specific user?

Answer 1

Looks like that filter query is missing right bracket ) for any

var directoryAudits = await graphClient.AuditLogs.
DirectoryAudits
.Request()
.Filter($"targetResources/any(c:c/id eq '{id}')")
.GetAsync();