Use the M365 Audit Log as a source for EventStreams

[fbcideas_migusr]

Currently there is a tremendous amount of value in the M365 Audit log, but it is extremely difficult to access. Retention is low for API access and other methods are batch oriented at best. Apart from some work in Sentinel, there are no ways to react to events in near real time. This seems like an obvious data source for the RTA workload in Fabric. Kusto could allow for as much retention as desired, and streaming would allow for reactions in near real time.

[Alicia_Li_MSFT]

Thanks for your input.

To support low latency events, Eventstream is planning to integrate with Microsoft Graph change notifications. This feature will enable multiple scenarios like event-driven applications, anomaly detection and real-time analysis on Microsoft Graph data. 

If this is blocking you, please consider using LogicApp and connect to Eventstream (with customEndpoint as source) as a short term solution.