Hi All,
For one of our SIEM Solutions, we fetch Azure AD audit events through /activity API. When fetching audit events for "Add administrative unit" the 'Modified Property' attribute is not available in the JSON response of the event.whereas we could
see the same attribute available in Azure portal 'Audit logs' page. There are few other events in 'Administrative Units' operations like 'Add member to Administrator Units' do get the below mentioned attribute in the JSON response.
This particular attribute is missing in ""
"modifiedProperties": [
{
"name": "AdministrativeUnit.ObjectID",
"oldValue": null,
"newValue": "\"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx\""
},
Please let me know if you anyone facing the similar issue.