Skip to main content

API calls for Microsoft 365

The Microsoft 365 connector makes API calls to Microsoft Graph API to retrieve data.

Authentication token​

The call uses the POST operation to retrieve an authentication token used in other Graph API calls.

URI: https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token

For more information, see Microsoft Graph docs .

Users​

The call uses the GET operation to retrieve information about Microsoft 365 users. The call differs depending on how the Domains field is populated when adding the connector.

URI when populated with *: https://graph.microsoft.com/v1.0/users?$select=accountEnabled,assignedLicenses,displayName,givenName,id,mail,onPremisesImmutableId,onPremisesLastSyncDateTime,surname,userPrincipalName,userType,createdDateTime,country,department&$top=999

URI when populated with domains: https://graph.microsoft.com/v1.0/users?$select=accountEnabled,assignedLicenses,displayName,givenName,id,mail,onPremisesImmutableId,onPremisesLastSyncDateTime,surname,userPrincipalName,userType,createdDateTime,country,department&$top=999&$count=true&ConsistencyLevel=eventual&$filter=endswith(userPrincipalName,'domain1') OR endswith(userPrincipalName,'domains2') ... for all domains added

Required permission: User: User.Read.All

For more information, see Microsoft Graph docs .

User registration details​

The call uses the GET operation to retrieve the multi-factor authentication details of the users.

URI: https://graph.microsoft.com/v1.0/reports/authenticationMethods/userRegistrationDetails

Required permission: AuditLog.Read.All

For more information, see Microsoft Graph docs .

Subscribed SKU​

The call uses the GET operation to retrieve information about the service SKUs that the company is subscribed to.

URI: https://graph.microsoft.com/v1.0/subscribedSkus

Required permission: LicenseAssignment.Read.All

For more information, see Microsoft Graph docs .

User changes​

The call uses the GET operation to retrieve newly created, updated, or deleted users without having to perform a full read of the entire user collection.

URI: https://graph.microsoft.com/v1.0/users/delta

Required permission: User: User.Read.All

For more information, see Microsoft Graph docs .

Reports​

The call uses the GET operation to retrieve information about applications activity and usage.

URI: https://graph.microsoft.com/v1.0/reports/

Required permission: Reports: Reports.Read.All

For more information, see Microsoft Graph docs .

Microsoft 365 Copilot usage​

note

This API endpoint is in beta.

The call uses the GET operation to retrieve information about activity data for users of Microsoft 365 Copilot apps.

URI: https://graph.microsoft.com/beta/reports/getMicrosoft365CopilotUsageUserDetail(period='D30')

Required permission: Reports: Reports.Read.All

For more information, see Microsoft Graph docs .

Sign Ins​

The call uses the GET operation to retrieve a list of sign-ins from the last 24 hours or since the last aggregation period.

note

From the list of retrieved applications, the connector exclusively fetches the Microsoft 365 related applications that are recognized in the Data Intelligence Service. For a list of the supported Microsoft 365 applications, expand the element below.

Supported Microsoft 365 applications
  • Microsoft Exchange
  • Microsoft OneDrive
  • Microsoft OneDrive
  • Microsoft Outlook
  • Microsoft SharePoint
  • Microsoft Skype
  • Microsoft Teams
  • Microsoft Yammer
  • Microsoft Copilot
  • Microsoft PowerBi
  • Microsoft Visio
  • Microsoft Project
  • Microsoft Office 365 Multi-Geo
  • Microsoft Power Virtual Agents
  • Microsoft Whiteboard
  • Microsoft Defender
  • Microsoft Security & Compliance Center
  • Microsoft Loop
  • Microsoft Viva
  • Microsoft PowerApps
  • Microsoft Outlook Online
  • Microsoft OneNote
  • Microsoft Sway
  • Microsoft Forms
  • Microsoft Viva Insights
  • Microsoft Advanced Threat Protection
  • Microsoft Entra ID
  • Windows 365
  • Microsoft Intune
  • Microsoft Office Online
  • Microsoft Delve
  • Microsoft Flow Portal
  • Microsoft Planner
  • Windows To Do
  • Microsoft Stream
  • Microsoft Dynamic 365

URI: https://graph.microsoft.com/v1.0/auditLogs/signIns

Required permission: AuditLog.Read.All

For more information, see Microsoft Graph docs .