How to Retrieve AuditLog Queries from Microsoft Purview Using Graph SDK v5.56 (C#)?

Question

I am currently using Graph SDK v5.56 in C# to retrieve AuditLog data from Microsoft Purview. In Graph Explorer, I was able to successfully retrieve the data by calling the following endpoint:

https://graph.microsoft.com/beta/security/auditLog/queries

{
    "@odata.context": "https://graph.microsoft.com/beta/$metadata#security/auditLog/queries",
    "@odata.count": 12,
    "@microsoft.graph.tips": "Use $select to choose only the properties your app needs, as this can lead to performance improvements. For example: GET security/auditLog/queries?$select=administrativeUnitIdFilters,displayName",
    "value": [
        {
            "id": "guid",
            "displayName": "AuditLog_CreatedByGraph2",
            "filterStartDateTime": "2024-07-01T00:00:00Z",
            "filterEndDateTime": "2024-08-09T00:00:00Z",
            "recordTypeFilters": [],
            "keywordFilter": "",
            "serviceFilters": [],
            "operationFilters": [
                "filesensitivitylabelapplied"
            ],
            "userPrincipalNameFilters": [],
            "ipAddressFilters": [],
            "objectIdFilters": [],
            "administrativeUnitIdFilters": [],
            "status": "succeeded"
        }
        ...
    ]
}

However, when trying to achieve the same result using the Graph SDK, I noticed that graphServiceClient.Security.AuditLog.Queries doesn't seem to exist (there is no AuditLog property after Security). I tried using the following approach to fetch the AuditLog queries:

var result = graphServiceClient.Security.WithUrl("https://graph.microsoft.com/beta/security/auditLog/queries")
        .GetAsync()
        .GetAwaiter()
        .GetResult();

But this approach returned 0 results.

How can I retrieve the same results using the Graph SDK in C# as I do with the Graph Explorer? Any guidance would be appreciated!

Answer 1

You need to use The Microsoft Graph Client Beta Library SDK, because audit log queries are available only in beta. Then you should be able to retrieve audit log queries

var result = await graphClientBeta.Security.AuditLog.Queries.GetAsync();

You should be able to use Microsoft.Graph and Microsoft.Graph.Beta side by side, because both libraries are using different namespaces

https://github.com/microsoftgraph/msgraph-sdk-dotnet/blob/dev/docs/upgrade-to-v5.md#namespacesusings-changes