API calls for Microsoft 365
The Microsoft 365 connector makes API calls to Microsoft Graph API to retrieve data.
Authentication token
The call uses the POST operation to retrieve an authentication token used in other Graph API calls.
URI: https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token
For more information, see Microsoft Graph docs .
Users
The call uses the GET operation to retrieve information about Microsoft 365 users. The call differs depending on how the Domains field is populated when adding the connector.
URI when populated with *: https://graph.microsoft.com/v1.0/users?$select=accountEnabled,assignedLicenses,displayName,givenName,id,mail,onPremisesImmutableId,onPremisesLastSyncDateTime,surname,userPrincipalName,userType,createdDateTime,country,department&$top=999
URI when populated with domains: https://graph.microsoft.com/v1.0/users?$select=accountEnabled,assignedLicenses,displayName,givenName,id,mail,onPremisesImmutableId,onPremisesLastSyncDateTime,surname,userPrincipalName,userType,createdDateTime,country,department&$top=999&$count=true&ConsistencyLevel=eventual&$filter=endswith(userPrincipalName,'domain1') OR endswith(userPrincipalName,'domains2') ... for all domains added
Required permission: User: User.Read.All
For more information, see Microsoft Graph docs .
User registration details
The call uses the GET operation to retrieve the multi-factor authentication details of the users.
URI: https://graph.microsoft.com/v1.0/reports/authenticationMethods/userRegistrationDetails
Required permission: AuditLog.Read.All
For more information, see Microsoft Graph docs .
Subscribed SKU
The call uses the GET operation to retrieve information about the service SKUs that the company is subscribed to.
URI: https://graph.microsoft.com/v1.0/subscribedSkus
Required permission: LicenseAssignment.Read.All
For more information, see Microsoft Graph docs .
User changes
The call uses the GET operation to retrieve newly created, updated, or deleted users without having to perform a full read of the entire user collection.
URI: https://graph.microsoft.com/v1.0/users/delta
Required permission: User: User.Read.All
For more information, see Microsoft Graph docs .
Reports
Activity data for Microsoft 365 usage reports generally becomes available within 48 hours, though can take up to several days. The data shown on the SaaS pages reflects this delay in availability. For information, see Microsoft 365 Reports in the admin center .
The call uses the GET operation to retrieve information about applications activity and usage.
URI: https://graph.microsoft.com/v1.0/reports/
Required permission: Reports: Reports.Read.All
For more information, see Microsoft Graph docs .
Microsoft 365 Copilot usage
- This API endpoint is in beta.
- Activity data for a given day is made available in the Microsoft 365 Copilot usage report within 72 hours of the end of that day, in UTC. The data shown on the SaaS pages reflects this delay in availability. For information, see Microsoft 365 Copilot usage .
The call uses the GET operation to retrieve information about activity data for users of Microsoft 365 Copilot apps.
URI: https://graph.microsoft.com/beta/reports/getMicrosoft365CopilotUsageUserDetail(period='D30')
Required permission: Reports: Reports.Read.All
For more information, see Microsoft Graph docs .
Sign Ins
The call uses the GET operation to retrieve a list of sign-ins from the last 24 hours or since the last aggregation period.
From the list of retrieved applications, the connector exclusively fetches the Microsoft 365 related applications that are recognized in the Data Intelligence Service. For a list of the supported Microsoft 365 applications, expand the element below.Supported Microsoft 365 applications
URI: https://graph.microsoft.com/v1.0/auditLogs/signIns
Required permission: AuditLog.Read.All
For more information, see Microsoft Graph docs .