Skip to main content
Last updated on

Ingest data from Microsoft 365

Beta

This feature is in Beta. To use it, a workspace admin must turn on Lakeflow Connect for Microsoft 365 Unified Audit Logs from the Previews page. See Manage Databricks previews.

Use Declarative Automation Bundles or a Databricks notebook to create a managed Microsoft 365 Unified Audit Logs pipeline for any of the five supported audit log source tables.

Requirements​

  • To create an ingestion pipeline, first meet the following requirements:

    • Your workspace must be enabled for Unity Catalog.

    • Serverless compute must be enabled for your workspace. See Serverless compute requirements.

    • To create a new connection, you must have CREATE CONNECTION privileges on the metastore. See Manage privileges in Unity Catalog.

      If the connector supports UI-based pipeline authoring, an admin can create the connection and the pipeline at the same time by completing the steps on this page. However, if the users who create pipelines use API-based pipeline authoring or are non-admin users, an admin must first create the connection in Catalog Explorer. See Connect to managed ingestion sources.

    • To use an existing connection, you must have USE CONNECTION privileges or ALL PRIVILEGES on the connection object.

    • You must have USE CATALOG privileges on the target catalog.

    • You must have USE SCHEMA and CREATE TABLE privileges on an existing schema or CREATE SCHEMA privileges on the target catalog.

  • Configure authentication from Databricks and create a connection. See Configure authentication to Microsoft 365 and Create a Microsoft 365 Unified Audit Logs connection.

  • Choose the source objects to ingest. For the supported objects, see Supported source tables.

Connector options​

The Microsoft 365 Unified Audit Logs connector doesn't define connector-specific pipeline options. For connection settings, see Connection options.

Create an ingestion pipeline​

Create the pipeline with Declarative Automation Bundles or a Databricks notebook. While the connector is in Beta, set the pipeline channel to PREVIEW.

Use Declarative Automation Bundles to manage Microsoft 365 Unified Audit Logs pipelines as code. Bundles can contain YAML definitions of pipelines and jobs, are managed using the Databricks CLI, and can be shared across development, staging, and production workspaces. For more information, see What are Declarative Automation Bundles?.

  1. Create a bundle using the Databricks CLI:

    Bash
    databricks bundle init

  2. Add a pipeline definition file, such as resources/microsoft_365_pipeline.yml. See pipeline.ingestion_definition and Examples.

  3. Add a job definition file, such as resources/microsoft_365_job.yml, to run the pipeline more frequently than every seven days.

  4. Deploy the pipeline using the Databricks CLI:

    Bash
    databricks bundle deploy

Examples​

The Microsoft 365 Unified Audit Logs connector makes five source tables available in the default source schema. The following examples ingest Entra ID, Exchange, SharePoint, general, and data loss prevention audit events.

The following pipeline definition file ingests all five source tables:

YAML
resources:
  pipelines:
    microsoft_365_pipeline:
      name: microsoft_365_pipeline
      channel: PREVIEW
      catalog: 'main'
      target: 'microsoft_365_data'
      ingestion_definition:
        connection_name: microsoft_365_connection
        objects:
          - table:
              source_schema: 'default'
              source_table: 'audit_azure_active_directory'
              destination_catalog: 'main'
              destination_schema: 'microsoft_365_data'
              destination_table: 'audit_azure_active_directory'
          - table:
              source_schema: 'default'
              source_table: 'audit_exchange'
              destination_catalog: 'main'
              destination_schema: 'microsoft_365_data'
              destination_table: 'audit_exchange'
          - table:
              source_schema: 'default'
              source_table: 'audit_sharepoint'
              destination_catalog: 'main'
              destination_schema: 'microsoft_365_data'
              destination_table: 'audit_sharepoint'
          - table:
              source_schema: 'default'
              source_table: 'audit_general'
              destination_catalog: 'main'
              destination_schema: 'microsoft_365_data'
              destination_table: 'audit_general'
          - table:
              source_schema: 'default'
              source_table: 'dlp_all'
              destination_catalog: 'main'
              destination_schema: 'microsoft_365_data'
              destination_table: 'dlp_all'
note

To ingest dlp_all, grant the ActivityFeed.ReadDlp application permission to the Microsoft Entra application. See Configure API permissions.

Declarative Automation Bundles job definition file​

The following job definition runs the ingestion pipeline daily. Run the pipeline more frequently than every seven days because Microsoft makes Management Activity API content available for a limited time.

YAML
resources:
  jobs:
    microsoft_365_job:
      name: microsoft_365_job
      schedule:
        quartz_cron_expression: '0 0 0 * * ?'
        timezone_id: 'UTC'
      tasks:
        - task_key: microsoft_365_ingestion
          pipeline_task:
            pipeline_id: ${resources.pipelines.microsoft_365_pipeline.id}

Common patterns​

For advanced pipeline configurations, see Common patterns for managed ingestion pipelines.

Next steps​

Start, schedule, and set alerts on your pipeline. See Common pipeline maintenance tasks.

Additional resources​

On this page