Create a Microsoft 365 Unified Audit Logs connection

Beta

This feature is in Beta. To use it, a workspace admin must turn on Lakeflow Connect for Microsoft 365 Unified Audit Logs from the Previews page. See Manage Databricks previews.

Create a Microsoft 365 Unified Audit Logs connection in Catalog Explorer to store authentication credentials for Lakeflow Connect ingestion. Any user with the USE CONNECTION privilege on the connection can create ingestion pipelines without direct access to the client secret.

For privilege requirements, see Connect to managed ingestion sources.

Prerequisites

Complete the source setup. Use the tenant ID, client ID, and client secret from the registered Microsoft Entra application.

Subscription plans

Select the plan that matches the Microsoft cloud environment that hosts your tenant. Enterprise is initially selected. For the supported plans and corresponding API hosts, see Subscription plans.

If you don't know your tenant's cloud environment, ask your Microsoft 365 administrator.

Create a connection

1. In the Databricks workspace, click Catalog > Create > Create a connection.
2. On the Connection basics page of the Set up connection wizard, specify a Connection name.
3. In the Connection type drop-down menu, select Microsoft 365 Unified Audit Logs.
4. (Optional) Add a comment.
5. Click Next.
6. On the Authentication page, enter the following values from Configure authentication to Microsoft 365:
   • Tenant ID: The Directory (tenant) ID of your Microsoft Entra tenant.
   • Client ID: The Application (client) ID of your Microsoft Entra application.
   • Client secret: The client secret value. Do not enter the Secret ID.
   • Subscription plan: The Microsoft cloud environment that hosts your tenant.
7. Click Create connection.

Next steps

Create an ingestion pipeline.