Created by Claude - please verify

Directory changes - 'sensitive' is a keyword heuristic, not a security classification.

Required Microsoft Graph permissions

AuditLog.Read.All — application permission, granted to the app registration with admin consent.

Licence: Audit log retention is set by tenant licence - roughly 7 days on Free and 30 days with Microsoft Entra ID P1/P2.

Endpoint: GET /v1.0/auditLogs/directoryAudits

This report reads the last 30 days and stops at 5,000 rows. It is a recent-activity view, not an archive.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Directory Changes (last 30 days)

What changed in Entra ID: role assignments, policy edits, application consent, credential changes, user and group management. Source: Microsoft Graph auditLogs/directoryAudits. Microsoft retains this data for a limited window (days to weeks depending on licence tier), and this report is capped at 5000 rows - so it is a recent-activity view, not an archive.

No directory changes were returned for this period. Please contact support if this is not the expected result.