Forum Discussion
Incomplete data from Search-UnifiedAuditLog cmdlet for AzureAD record type
Please find attached an sample of the audit log (value of "AuditData"), i have replaced some values with an place-holder ("foobar")
{"CreationTime":"2018-11-10T20:00:14","Id":"foobar","Operation":"CrmDefaultActivity","OrganizationId":"foobar","RecordType":21,"ResultStatus":"Success","UserKey":"Unknown","UserType":2,"Version":1,"Workload":"CRM","ClientIP":"127.0.0.1","ObjectId":"Create email","UserId":"drt@alfapeople.com","CrmOrganizationUniqueName":"foobar","Fields":[{"Name":"subject","Value":"foobar"},{"Name":"description","Value":"foobar"},{"Name":"ownerid","Value":"foobar"},{"Name":"from","Value":"Microsoft.Xrm.Sdk.Entity[]"},{"Name":"to","Value":"Microsoft.Xrm.Sdk.Entity[]"},{"Name":"cc","Value":"Microsoft.Xrm.Sdk.Entity[]"},{"Name":"regardingobjectid","Value":"foobar"},{"Name":"isworkflowcreated","Value":"False"},{"Name":"notifications","Value":"0"},{"Name":"followemailuserpreference","Value":"False"},{"Name":"readreceiptrequested","Value":"False"},{"Name":"foobar","Value":"False"},{"Name":"emailreminderstatus","Value":"0"},{"Name":"isemailfollowed","Value":"False"},{"Name":"emailremindertype","Value":"0"},{"Name":"isregularactivity","Value":"False"},{"Name":"deliveryreceiptrequested","Value":"False"},{"Name":"deliveryprioritycode","Value":"1"},{"Name":"isemailreminderset","Value":"False"},{"Name":"compressed","Value":"False"},{"Name":"prioritycode","Value":"1"},{"Name":"directioncode","Value":"True"},{"Name":"correlationmethod","Value":"0"},{"Name":"activityid","Value":"foobar"}],"InstanceUrl":"https:\/\/foobar.crm4.dynamics.com\/","ItemType":"Dynamics365","ItemUrl":"https:\/\/foobar.crm4.dynamics.com\/main.aspx?etn=email&pagetype=entityrecord&id=foobar","UserAgent":"","CorrelationId":"00000000-0000-0000-0000-000000000000","EntityId":"foobar","EntityName":"email","Message":"Create","PrimaryFieldValue":"","Query":"","QueryResults":"","ServiceContextId":"00000000-0000-0000-0000-000000000000","ServiceContextIdType":"","ServiceName":"Dynamics365","SystemUserId":"foobar","UserUp