Referência do conector do Microsoft 365 Unified Audit Logs

info

Beta

Esse recurso está em Beta. Para usá-lo, o administrador do workspace deve ativar o Lakeflow Connect for Microsoft 365 Unified Audit Logs na página Pré-visualizações . Consulte Gerenciar prévias do Databricks.

O conector gerenciado Microsoft 365 Unified Audit Logs é compatível com cinco tabelas de origem de log de auditoria unificado. Esta referência lista as tabelas, os esquemas de tabela de destino, as opções de conexão, os planos de inscrição e as permissões do Microsoft 365.

Tabelas de origem suportadas

O conector Microsoft 365 Unified Audit Logs é compatível com as seguintes tabelas de origem no esquema de origem default. Todas as cinco tabelas usam lw_id como chave primária, usam sincronização incremental e usam time como campo de cursor.

Tabela de origem	Chave primária	Descrição	Tipo de conteúdo da API do Microsoft Management Activity	Modo de sincronização	Campo de cursor
`audit_azure_active_directory`	`lw_id`	Eventos da ID do Microsoft Entra, incluindo inícios de sessão, acesso a aplicativos e alterações de diretório.	`Audit.AzureActiveDirectory`	Incremental	`time`
`audit_exchange`	`lw_id`	Exchange events, including mailbox, folder, and item operations.	`Audit.Exchange`	Incremental	`time`
`audit_sharepoint`	`lw_id`	Eventos do SharePoint e OneDrive, incluindo arquivo, pasta, compartilhamento e operações de site.	`Audit.SharePoint`	Incremental	`time`
`audit_general`	`lw_id`	Eventos de auditoria do Microsoft 365 que não estão incluídos nos outros tipos de conteúdo específicos de cargas de trabalho.	`Audit.General`	Incremental	`time`
`dlp_all`	`lw_id`	Eventos de prevenção contra perda de dados em cargas de trabalho do Microsoft 365 compatíveis.	`DLP.All`	Incremental	`time`

Tabela de origem	Chave primária	Descrição	Tipo de conteúdo da API do Microsoft Management Activity	Modo de sincronização	Campo de cursor
`audit_azure_active_directory`	`lw_id`	Eventos da ID do Microsoft Entra, incluindo inícios de sessão, acesso a aplicativos e alterações de diretório.	`Audit.AzureActiveDirectory`	Incremental	`time`
`audit_exchange`	`lw_id`	Exchange events, including mailbox, folder, and item operations.	`Audit.Exchange`	Incremental	`time`
`audit_sharepoint`	`lw_id`	Eventos do SharePoint e OneDrive, incluindo arquivo, pasta, compartilhamento e operações de site.	`Audit.SharePoint`	Incremental	`time`
`audit_general`	`lw_id`	Eventos de auditoria do Microsoft 365 que não estão incluídos nos outros tipos de conteúdo específicos de cargas de trabalho.	`Audit.General`	Incremental	`time`
`dlp_all`	`lw_id`	Eventos de prevenção contra perda de dados em cargas de trabalho do Microsoft 365 compatíveis.	`DLP.All`	Incremental	`time`

Para definições de campos e esquemas de eventos específicos da carga de trabalho, consulte o esquema da API do Microsoft 365 Management Activity. A Microsoft pode adicionar campos e tipos de evento a esses payloads de origem.

Use os seguintes nomes de origem em uma definição de pipeline:

YAML
objects:
  - table:
      source_schema: 'default'
      source_table: 'audit_azure_active_directory'
  - table:
      source_schema: 'default'
      source_table: 'audit_exchange'
  - table:
      source_schema: 'default'
      source_table: 'audit_sharepoint'
  - table:
      source_schema: 'default'
      source_table: 'audit_general'
  - table:
      source_schema: 'default'
      source_table: 'dlp_all'

Para obter uma definição de pipeline completa, consulte Exemplos.

Esquemas de tabela de destino

Todas as tabelas usam lw_id como a chave principal e time como o campo de cursor. Cada tabela de destino também inclui os campos de origem que a Microsoft retorna para seu tipo de conteúdo. A Microsoft pode adicionar campos e tipos de evento a esses payloads de origem; portanto, para ver a lista de campos completa e oficial, consulte o esquema da API de Atividade de Gerenciamento do Microsoft 365.

`audit_azure_active_directory`

key primária: lw_id Campo de cursor: time

campo	Tipo de dados
`lw_id`	`STRING`
`time`	`TIMESTAMP`
`Id`	`STRING`
`RecordType`	`INT`
`CreationTime`	`TIMESTAMP`
`Operation`	`STRING`
`OrganizationId`	`STRING`
`UserType`	`INT`
`UserKey`	`STRING`
`Workload`	`STRING`
`Version`	`INT`
`ResultStatus`	`STRING`
`ObjectId`	`STRING`
`UserId`	`STRING`
`ClientIP`	`STRING`
`Scope`	`STRING`
`AppAccessContext`	`STRUCT<AADSessionId: STRING, APIId: STRING, ClientAppId: STRING, ClientAppName: STRING, CorrelationId: STRING>`
`AzureActiveDirectoryEventType`	`INT`
`ExtendedProperties`	`ARRAY<STRUCT<Name: STRING, Value: STRING>>`
`ModifiedProperties`	`ARRAY<MAP<STRING, VARIANT>>`
`DeviceProperties`	`ARRAY<STRUCT<Name: STRING, Value: STRING>>`
`Application`	`STRING`
`Client`	`STRING`
`LoginStatus`	`INT`
`UserDomain`	`STRING`
`Actor`	`ARRAY<STRUCT<ID: STRING, Type: INT>>`
`ActorContextId`	`STRING`
`ActorIpAddress`	`STRING`
`InterSystemsId`	`STRING`
`IntraSystemId`	`STRING`
`SupportTicketId`	`STRING`
`Target`	`ARRAY<STRUCT<ID: STRING, Type: INT>>`
`TargetContextId`	`STRING`
`ApplicationId`	`STRING`
`ErrorNumber`	`STRING`
`LogonError`	`STRING`

campo	Tipo de dados
`lw_id`	`STRING`
`time`	`TIMESTAMP`
`Id`	`STRING`
`RecordType`	`INT`
`CreationTime`	`TIMESTAMP`
`Operation`	`STRING`
`OrganizationId`	`STRING`
`UserType`	`INT`
`UserKey`	`STRING`
`Workload`	`STRING`
`Version`	`INT`
`ResultStatus`	`STRING`
`ObjectId`	`STRING`
`UserId`	`STRING`
`ClientIP`	`STRING`
`Scope`	`STRING`
`AppAccessContext`	`STRUCT<AADSessionId: STRING, APIId: STRING, ClientAppId: STRING, ClientAppName: STRING, CorrelationId: STRING>`
`AzureActiveDirectoryEventType`	`INT`
`ExtendedProperties`	`ARRAY<STRUCT<Name: STRING, Value: STRING>>`
`ModifiedProperties`	`ARRAY<MAP<STRING, VARIANT>>`
`DeviceProperties`	`ARRAY<STRUCT<Name: STRING, Value: STRING>>`
`Application`	`STRING`
`Client`	`STRING`
`LoginStatus`	`INT`
`UserDomain`	`STRING`
`Actor`	`ARRAY<STRUCT<ID: STRING, Type: INT>>`
`ActorContextId`	`STRING`
`ActorIpAddress`	`STRING`
`InterSystemsId`	`STRING`
`IntraSystemId`	`STRING`
`SupportTicketId`	`STRING`
`Target`	`ARRAY<STRUCT<ID: STRING, Type: INT>>`
`TargetContextId`	`STRING`
`ApplicationId`	`STRING`
`ErrorNumber`	`STRING`
`LogonError`	`STRING`

`audit_exchange`

key primária: lw_id Campo de cursor: time

campo	Tipo de dados
`lw_id`	`STRING`
`time`	`TIMESTAMP`
`Id`	`STRING`
`RecordType`	`INT`
`CreationTime`	`TIMESTAMP`
`Operation`	`STRING`
`OrganizationId`	`STRING`
`UserType`	`INT`
`UserKey`	`STRING`
`Workload`	`STRING`
`Version`	`INT`
`ResultStatus`	`STRING`
`ObjectId`	`STRING`
`UserId`	`STRING`
`ClientIP`	`STRING`
`Scope`	`STRING`
`AppAccessContext`	`STRUCT<AADSessionId: STRING, APIId: STRING, ClientAppId: STRING, ClientAppName: STRING, CorrelationId: STRING>`
`ModifiedObjectResolvedName`	`STRING`
`Parameters`	`ARRAY<STRUCT<Name: STRING, Value: STRING>>`
`ModifiedProperties`	`ARRAY<MAP<STRING, VARIANT>>`
`ExternalAccess`	`BOOLEAN`
`OriginatingServer`	`STRING`
`OrganizationName`	`STRING`
`LogonType`	`INT`
`InternalLogonType`	`INT`
`MailboxGuid`	`STRING`
`MailboxOwnerUPN`	`STRING`
`MailboxOwnerSid`	`STRING`
`MailboxOwnerMasterAccountSid`	`STRING`
`LogonUserSid`	`STRING`
`LogonUserDisplayName`	`STRING`
`ClientInfoString`	`STRING`
`ClientIPAddress`	`STRING`
`ClientMachineName`	`STRING`
`ClientProcessName`	`STRING`
`ClientVersion`	`STRING`
`Folder`	`STRUCT<Id: STRING, Path: STRING, FolderItems: ARRAY<STRUCT<Id: STRING, ImmutableId: STRING, InternetMessageId: STRING, CreationTime: TIMESTAMP, Subject: STRING, SizeInBytes: BIGINT, Sensitivity: STRING, ClientRequestId: STRING, Teams: VARIANT>>>`
`CrossMailboxOperations`	`BOOLEAN`
`DestMailboxId`	`STRING`
`DestMailboxOwnerUPN`	`STRING`
`DestMailboxOwnerSid`	`STRING`
`DestMailboxOwnerMasterAccountSid`	`STRING`
`DestFolder`	`STRUCT<Id: STRING, Path: STRING, FolderItems: ARRAY<STRUCT<Id: STRING, ImmutableId: STRING, InternetMessageId: STRING, CreationTime: TIMESTAMP, Subject: STRING, SizeInBytes: BIGINT, Sensitivity: STRING, ClientRequestId: STRING, Teams: VARIANT>>>`
`Folders`	`ARRAY<STRUCT<Id: STRING, Path: STRING, FolderItems: ARRAY<STRUCT<Id: STRING, ImmutableId: STRING, InternetMessageId: STRING, CreationTime: TIMESTAMP, Subject: STRING, SizeInBytes: BIGINT, Sensitivity: STRING, ClientRequestId: STRING, Teams: VARIANT>>>>`
`AffectedItems`	`ARRAY<STRUCT<Id: STRING, Subject: STRING, ParentFolder: STRUCT<Id: STRING, Path: STRING, FolderItems: ARRAY<STRUCT<Id: STRING, ImmutableId: STRING, InternetMessageId: STRING, CreationTime: TIMESTAMP, Subject: STRING, SizeInBytes: BIGINT, Sensitivity: STRING, ClientRequestId: STRING, Teams: VARIANT>>>, Attachments: STRING>>`
`Item`	`STRUCT<Id: STRING, Subject: STRING, ParentFolder: STRUCT<Id: STRING, Path: STRING, FolderItems: ARRAY<STRUCT<Id: STRING, ImmutableId: STRING, InternetMessageId: STRING, CreationTime: TIMESTAMP, Subject: STRING, SizeInBytes: BIGINT, Sensitivity: STRING, ClientRequestId: STRING, Teams: VARIANT>>>, Attachments: STRING>`
`SendAsUserSmtp`	`STRING`
`SendAsUserMailboxGuid`	`STRING`
`SendOnBehalfOfUserSmtp`	`STRING`
`SendOnBehalfOfUserMailboxGuid`	`STRING`

campo	Tipo de dados
`lw_id`	`STRING`
`time`	`TIMESTAMP`
`Id`	`STRING`
`RecordType`	`INT`
`CreationTime`	`TIMESTAMP`
`Operation`	`STRING`
`OrganizationId`	`STRING`
`UserType`	`INT`
`UserKey`	`STRING`
`Workload`	`STRING`
`Version`	`INT`
`ResultStatus`	`STRING`
`ObjectId`	`STRING`
`UserId`	`STRING`
`ClientIP`	`STRING`
`Scope`	`STRING`
`AppAccessContext`	`STRUCT<AADSessionId: STRING, APIId: STRING, ClientAppId: STRING, ClientAppName: STRING, CorrelationId: STRING>`
`ModifiedObjectResolvedName`	`STRING`
`Parameters`	`ARRAY<STRUCT<Name: STRING, Value: STRING>>`
`ModifiedProperties`	`ARRAY<MAP<STRING, VARIANT>>`
`ExternalAccess`	`BOOLEAN`
`OriginatingServer`	`STRING`
`OrganizationName`	`STRING`
`LogonType`	`INT`
`InternalLogonType`	`INT`
`MailboxGuid`	`STRING`
`MailboxOwnerUPN`	`STRING`
`MailboxOwnerSid`	`STRING`
`MailboxOwnerMasterAccountSid`	`STRING`
`LogonUserSid`	`STRING`
`LogonUserDisplayName`	`STRING`
`ClientInfoString`	`STRING`
`ClientIPAddress`	`STRING`
`ClientMachineName`	`STRING`
`ClientProcessName`	`STRING`
`ClientVersion`	`STRING`
`Folder`	`STRUCT<Id: STRING, Path: STRING, FolderItems: ARRAY<STRUCT<Id: STRING, ImmutableId: STRING, InternetMessageId: STRING, CreationTime: TIMESTAMP, Subject: STRING, SizeInBytes: BIGINT, Sensitivity: STRING, ClientRequestId: STRING, Teams: VARIANT>>>`
`CrossMailboxOperations`	`BOOLEAN`
`DestMailboxId`	`STRING`
`DestMailboxOwnerUPN`	`STRING`
`DestMailboxOwnerSid`	`STRING`
`DestMailboxOwnerMasterAccountSid`	`STRING`
`DestFolder`	`STRUCT<Id: STRING, Path: STRING, FolderItems: ARRAY<STRUCT<Id: STRING, ImmutableId: STRING, InternetMessageId: STRING, CreationTime: TIMESTAMP, Subject: STRING, SizeInBytes: BIGINT, Sensitivity: STRING, ClientRequestId: STRING, Teams: VARIANT>>>`
`Folders`	`ARRAY<STRUCT<Id: STRING, Path: STRING, FolderItems: ARRAY<STRUCT<Id: STRING, ImmutableId: STRING, InternetMessageId: STRING, CreationTime: TIMESTAMP, Subject: STRING, SizeInBytes: BIGINT, Sensitivity: STRING, ClientRequestId: STRING, Teams: VARIANT>>>>`
`AffectedItems`	`ARRAY<STRUCT<Id: STRING, Subject: STRING, ParentFolder: STRUCT<Id: STRING, Path: STRING, FolderItems: ARRAY<STRUCT<Id: STRING, ImmutableId: STRING, InternetMessageId: STRING, CreationTime: TIMESTAMP, Subject: STRING, SizeInBytes: BIGINT, Sensitivity: STRING, ClientRequestId: STRING, Teams: VARIANT>>>, Attachments: STRING>>`
`Item`	`STRUCT<Id: STRING, Subject: STRING, ParentFolder: STRUCT<Id: STRING, Path: STRING, FolderItems: ARRAY<STRUCT<Id: STRING, ImmutableId: STRING, InternetMessageId: STRING, CreationTime: TIMESTAMP, Subject: STRING, SizeInBytes: BIGINT, Sensitivity: STRING, ClientRequestId: STRING, Teams: VARIANT>>>, Attachments: STRING>`
`SendAsUserSmtp`	`STRING`
`SendAsUserMailboxGuid`	`STRING`
`SendOnBehalfOfUserSmtp`	`STRING`
`SendOnBehalfOfUserMailboxGuid`	`STRING`

`audit_sharepoint`

key primária: lw_id Campo de cursor: time

campo	Tipo de dados
`lw_id`	`STRING`
`time`	`TIMESTAMP`
`Id`	`STRING`
`RecordType`	`INT`
`CreationTime`	`TIMESTAMP`
`Operation`	`STRING`
`OrganizationId`	`STRING`
`UserType`	`INT`
`UserKey`	`STRING`
`Workload`	`STRING`
`Version`	`INT`
`ResultStatus`	`STRING`
`ObjectId`	`STRING`
`UserId`	`STRING`
`ClientIP`	`STRING`
`Scope`	`STRING`
`AppAccessContext`	`STRUCT<AADSessionId: STRING, APIId: STRING, ClientAppId: STRING, ClientAppName: STRING, CorrelationId: STRING>`
`Site`	`STRING`
`ItemType`	`STRING`
`EventSource`	`STRING`
`SourceName`	`STRING`
`UserAgent`	`STRING`
`MachineDomainInfo`	`STRING`
`MachineId`	`STRING`
`ListItemUniqueId`	`STRING`
`ListId`	`STRING`
`ApplicationId`	`STRING`
`ApplicationDisplayName`	`STRING`
`IsWorkflow`	`BOOLEAN`
`SiteUrl`	`STRING`
`SourceRelativeUrl`	`STRING`
`SourceFileName`	`STRING`
`SourceFileExtension`	`STRING`
`DestinationRelativeUrl`	`STRING`
`DestinationFileName`	`STRING`
`DestinationFileExtension`	`STRING`
`UserSharedWith`	`STRING`
`SharingType`	`STRING`
`SourceLabel`	`STRING`
`DestinationLabel`	`STRING`
`SensitivityLabelOwnerEmail`	`STRING`
`SensitivityLabelId`	`STRING`
`ListTitle`	`STRING`
`ListName`	`STRING`
`ListUrl`	`STRING`
`ListBaseType`	`STRING`
`ListBaseTemplateType`	`STRING`
`IsHiddenList`	`BOOLEAN`
`IsDocLib`	`BOOLEAN`
`TargetUserOrGroupName`	`STRING`
`TargetUserOrGroupType`	`STRING`
`UniqueSharingId`	`STRING`
`CustomEvent`	`STRING`
`EventData`	`STRING`
`ModifiedProperties`	`ARRAY<MAP<STRING, VARIANT>>`

campo	Tipo de dados
`lw_id`	`STRING`
`time`	`TIMESTAMP`
`Id`	`STRING`
`RecordType`	`INT`
`CreationTime`	`TIMESTAMP`
`Operation`	`STRING`
`OrganizationId`	`STRING`
`UserType`	`INT`
`UserKey`	`STRING`
`Workload`	`STRING`
`Version`	`INT`
`ResultStatus`	`STRING`
`ObjectId`	`STRING`
`UserId`	`STRING`
`ClientIP`	`STRING`
`Scope`	`STRING`
`AppAccessContext`	`STRUCT<AADSessionId: STRING, APIId: STRING, ClientAppId: STRING, ClientAppName: STRING, CorrelationId: STRING>`
`Site`	`STRING`
`ItemType`	`STRING`
`EventSource`	`STRING`
`SourceName`	`STRING`
`UserAgent`	`STRING`
`MachineDomainInfo`	`STRING`
`MachineId`	`STRING`
`ListItemUniqueId`	`STRING`
`ListId`	`STRING`
`ApplicationId`	`STRING`
`ApplicationDisplayName`	`STRING`
`IsWorkflow`	`BOOLEAN`
`SiteUrl`	`STRING`
`SourceRelativeUrl`	`STRING`
`SourceFileName`	`STRING`
`SourceFileExtension`	`STRING`
`DestinationRelativeUrl`	`STRING`
`DestinationFileName`	`STRING`
`DestinationFileExtension`	`STRING`
`UserSharedWith`	`STRING`
`SharingType`	`STRING`
`SourceLabel`	`STRING`
`DestinationLabel`	`STRING`
`SensitivityLabelOwnerEmail`	`STRING`
`SensitivityLabelId`	`STRING`
`ListTitle`	`STRING`
`ListName`	`STRING`
`ListUrl`	`STRING`
`ListBaseType`	`STRING`
`ListBaseTemplateType`	`STRING`
`IsHiddenList`	`BOOLEAN`
`IsDocLib`	`BOOLEAN`
`TargetUserOrGroupName`	`STRING`
`TargetUserOrGroupType`	`STRING`
`UniqueSharingId`	`STRING`
`CustomEvent`	`STRING`
`EventData`	`STRING`
`ModifiedProperties`	`ARRAY<MAP<STRING, VARIANT>>`

`audit_general`

key primária: lw_id Campo de cursor: time

campo	Tipo de dados
`lw_id`	`STRING`
`time`	`TIMESTAMP`
`Id`	`STRING`
`RecordType`	`INT`
`CreationTime`	`TIMESTAMP`
`Operation`	`STRING`
`OrganizationId`	`STRING`
`UserType`	`INT`
`UserKey`	`STRING`
`Workload`	`STRING`
`Version`	`INT`
`ResultStatus`	`STRING`
`ObjectId`	`STRING`
`UserId`	`STRING`
`ClientIP`	`STRING`
`Scope`	`STRING`
`AppAccessContext`	`STRUCT<AADSessionId: STRING, APIId: STRING, ClientAppId: STRING, ClientAppName: STRING, CorrelationId: STRING>`
`payload`	`VARIANT`

campo	Tipo de dados
`lw_id`	`STRING`
`time`	`TIMESTAMP`
`Id`	`STRING`
`RecordType`	`INT`
`CreationTime`	`TIMESTAMP`
`Operation`	`STRING`
`OrganizationId`	`STRING`
`UserType`	`INT`
`UserKey`	`STRING`
`Workload`	`STRING`
`Version`	`INT`
`ResultStatus`	`STRING`
`ObjectId`	`STRING`
`UserId`	`STRING`
`ClientIP`	`STRING`
`Scope`	`STRING`
`AppAccessContext`	`STRUCT<AADSessionId: STRING, APIId: STRING, ClientAppId: STRING, ClientAppName: STRING, CorrelationId: STRING>`
`payload`	`VARIANT`

`dlp_all`

key primária: lw_id Campo de cursor: time

campo	Tipo de dados
`lw_id`	`STRING`
`time`	`TIMESTAMP`
`Id`	`STRING`
`RecordType`	`INT`
`CreationTime`	`TIMESTAMP`
`Operation`	`STRING`
`OrganizationId`	`STRING`
`UserType`	`INT`
`UserKey`	`STRING`
`Workload`	`STRING`
`Version`	`INT`
`ResultStatus`	`STRING`
`ObjectId`	`STRING`
`UserId`	`STRING`
`ClientIP`	`STRING`
`Scope`	`STRING`
`AppAccessContext`	`STRUCT<AADSessionId: STRING, APIId: STRING, ClientAppId: STRING, ClientAppName: STRING, CorrelationId: STRING>`
`SharePointMetaData`	`STRUCT<From: STRING, itemCreationTime: TIMESTAMP, SiteCollectionGuid: STRING, SiteCollectionUrl: STRING, FileName: STRING, FileOwner: STRING, FilePathUrl: STRING, DocumentLastModifier: STRING, DocumentSharer: STRING, UniqueId: STRING, LastModifiedTime: TIMESTAMP, IsViewableByExternalUsers: BOOLEAN>`
`ExchangeMetaData`	`STRUCT<MessageID: STRING, From: STRING, To: ARRAY<STRING>, CC: ARRAY<STRING>, BCC: ARRAY<STRING>, Subject: STRING, Sent: TIMESTAMP, RecipientCount: INT>`
`EndPointMetaData`	`STRUCT<SensitiveInformation: ARRAY<STRUCT<Confidence: INT, Count: INT, Location: STRING, SensitiveType: STRING, SensitiveInformationDetections: STRUCT<DetectedValues: ARRAY<STRUCT<Name: STRING, Value: STRING>>, ResultsTruncated: BOOLEAN>, SensitiveInformationDetailedClassificationAttributes: ARRAY<STRUCT<Confidence: INT, Count: INT, IsMatch: BOOLEAN>>, SensitiveInformationTypeName: STRING, UniqueCount: INT>>, EnforcementMode: STRING, FileExtension: STRING, FileType: STRING, DeviceName: STRING>`
`ExceptionInfo`	`STRING`
`PolicyDetails`	ARRAY<STRUCT<PolicyId: STRING, PolicyName: STRING, Rules: ARRAY<STRUCT<RuleId: STRING, RuleName: STRING, Actions: ARRAY<STRING>, OverriddenActions: ARRAY<STRING>, Severity: STRING, RuleMode: STRING, ConditionsMatched: STRUCT<SensitiveInformation: ARRAY<STRUCT<Confidence: INT, Count: INT, Location: STRING, SensitiveType: STRING, SensitiveInformationDetections: STRUCT<DetectedValues: ARRAY<STRUCT<Name: STRING, Value: STRING>>, ResultsTruncated: BOOLEAN>, SensitiveInformationDetailedClassificationAttributes: ARRAY<STRUCT<Confidence: INT, Count: INT, IsMatch: BOOLEAN>>, SensitiveInformationTypeName: STRING, UniqueCount: INT>>, DocumentProperties: ARRAY<STRUCT<Name: STRING, Value: STRING>>, OtherConditions: ARRAY<STRUCT<Name: STRING, Value: STRING>>>>>>>
`SensitiveInfoDetectionIsIncluded`	`BOOLEAN`

campo	Tipo de dados
`lw_id`	`STRING`
`time`	`TIMESTAMP`
`Id`	`STRING`
`RecordType`	`INT`
`CreationTime`	`TIMESTAMP`
`Operation`	`STRING`
`OrganizationId`	`STRING`
`UserType`	`INT`
`UserKey`	`STRING`
`Workload`	`STRING`
`Version`	`INT`
`ResultStatus`	`STRING`
`ObjectId`	`STRING`
`UserId`	`STRING`
`ClientIP`	`STRING`
`Scope`	`STRING`
`AppAccessContext`	`STRUCT<AADSessionId: STRING, APIId: STRING, ClientAppId: STRING, ClientAppName: STRING, CorrelationId: STRING>`
`SharePointMetaData`	`STRUCT<From: STRING, itemCreationTime: TIMESTAMP, SiteCollectionGuid: STRING, SiteCollectionUrl: STRING, FileName: STRING, FileOwner: STRING, FilePathUrl: STRING, DocumentLastModifier: STRING, DocumentSharer: STRING, UniqueId: STRING, LastModifiedTime: TIMESTAMP, IsViewableByExternalUsers: BOOLEAN>`
`ExchangeMetaData`	`STRUCT<MessageID: STRING, From: STRING, To: ARRAY<STRING>, CC: ARRAY<STRING>, BCC: ARRAY<STRING>, Subject: STRING, Sent: TIMESTAMP, RecipientCount: INT>`
`EndPointMetaData`	`STRUCT<SensitiveInformation: ARRAY<STRUCT<Confidence: INT, Count: INT, Location: STRING, SensitiveType: STRING, SensitiveInformationDetections: STRUCT<DetectedValues: ARRAY<STRUCT<Name: STRING, Value: STRING>>, ResultsTruncated: BOOLEAN>, SensitiveInformationDetailedClassificationAttributes: ARRAY<STRUCT<Confidence: INT, Count: INT, IsMatch: BOOLEAN>>, SensitiveInformationTypeName: STRING, UniqueCount: INT>>, EnforcementMode: STRING, FileExtension: STRING, FileType: STRING, DeviceName: STRING>`
`ExceptionInfo`	`STRING`
`PolicyDetails`	ARRAY<STRUCT<PolicyId: STRING, PolicyName: STRING, Rules: ARRAY<STRUCT<RuleId: STRING, RuleName: STRING, Actions: ARRAY<STRING>, OverriddenActions: ARRAY<STRING>, Severity: STRING, RuleMode: STRING, ConditionsMatched: STRUCT<SensitiveInformation: ARRAY<STRUCT<Confidence: INT, Count: INT, Location: STRING, SensitiveType: STRING, SensitiveInformationDetections: STRUCT<DetectedValues: ARRAY<STRUCT<Name: STRING, Value: STRING>>, ResultsTruncated: BOOLEAN>, SensitiveInformationDetailedClassificationAttributes: ARRAY<STRUCT<Confidence: INT, Count: INT, IsMatch: BOOLEAN>>, SensitiveInformationTypeName: STRING, UniqueCount: INT>>, DocumentProperties: ARRAY<STRUCT<Name: STRING, Value: STRING>>, OtherConditions: ARRAY<STRUCT<Name: STRING, Value: STRING>>>>>>>
`SensitiveInfoDetectionIsIncluded`	`BOOLEAN`

Opções de conexão

Opção	Tipo	Obrigatório	Descrição
`tenant_id`	String	Sim	O ID do diretório (tenant) do tenant do Microsoft Entra.
`client_id`	String	Sim	A ID do aplicativo (cliente) do aplicativo Microsoft Entra registrado.
`client_secret`	String	Sim	O valor do segredo do cliente para o aplicativo registrado.
`subscription_plan`	String	Sim	O ambiente de cloud da Microsoft para o tenant. O Explorador de Catálogos seleciona inicialmente `enterprise`.

Opção	Tipo	Obrigatório	Descrição
`tenant_id`	String	Sim	O ID do diretório (tenant) do tenant do Microsoft Entra.
`client_id`	String	Sim	A ID do aplicativo (cliente) do aplicativo Microsoft Entra registrado.
`client_secret`	String	Sim	O valor do segredo do cliente para o aplicativo registrado.
`subscription_plan`	String	Sim	O ambiente de cloud da Microsoft para o tenant. O Explorador de Catálogos seleciona inicialmente `enterprise`.

Planos de inscrição

Nome de exibição	Valor	Host da API de gerenciamento de atividades
Enterprise	`enterprise`	`manage.office.com`
Government GCC	`gcc`	`manage-gcc.office.com`
Government GCC High	`gcc_high`	`manage.office365.us`
Governo DoD	`dod`	`manage.protection.apps.mil`

Nome de exibição	Valor	Host da API de gerenciamento de atividades
Enterprise	`enterprise`	`manage.office.com`
Government GCC	`gcc`	`manage-gcc.office.com`
Government GCC High	`gcc_high`	`manage.office365.us`
Governo DoD	`dod`	`manage.protection.apps.mil`

Permissões do Microsoft 365 necessárias

Permissão	Tipo	Necessário para
`ActivityFeed.Read`	Aplicativo	Lendo o conteúdo de `Audit.AzureActiveDirectory`, `Audit.Exchange`, `Audit.SharePoint` e `Audit.General`.
`ActivityFeed.ReadDlp`	Aplicativo	Lendo o conteúdo de `DLP.All` para a tabela de origem `dlp_all`.

Permissão	Tipo	Necessário para
`ActivityFeed.Read`	Aplicativo	Lendo o conteúdo de `Audit.AzureActiveDirectory`, `Audit.Exchange`, `Audit.SharePoint` e `Audit.General`.
`ActivityFeed.ReadDlp`	Aplicativo	Lendo o conteúdo de `DLP.All` para a tabela de origem `dlp_all`.

Um administrador deve conceder consentimento em todo o tenant para essas permissões. O conector não usa permissões delegadas.

Tabelas de origem suportadas​

Esquemas de tabela de destino​

audit_azure_active_directory​

audit_exchange​

audit_sharepoint​

audit_general​

dlp_all​

Opções de conexão​

Planos de inscrição​

Permissões do Microsoft 365 necessárias​

Tabelas de origem suportadas

Esquemas de tabela de destino

`audit_azure_active_directory`

`audit_exchange`

`audit_sharepoint`

`audit_general`

`dlp_all`

Opções de conexão

Planos de inscrição

Permissões do Microsoft 365 necessárias