Microsoft 365 Management Activity API
You can integrate the Microsoft 365 Management Activity API with Sophos XDR so that Microsoft 365 audit and security-related activity is collected, normalized, and available in the Sophos XDR Data Lake for search, reporting, and detections.
This page summarizes what that integration ingests and how it relates to Microsoft's API. For Entra app registration, certificates, permissions, and GCC / GCC High endpoints, use the full integration guide, Integrate Microsoft 365 Management Activity API.
Microsoft 365 Management Activity API product overview
The Microsoft Office 365 Management Activity API is Microsoft's unified auditing pipeline for Microsoft 365: user and admin actions across workloads such as Exchange, SharePoint, OneDrive, Microsoft Teams, Azure Active Directory (Entra ID) sign-in activity, and other services that emit management activity records.
Sophos Fusion collects this data through Microsoft's REST API (via the Sophos XDR cloud ingestor), not through customer-managed syslog or custom log shippers. In broad terms, the flow is: subscribe to activity content types Microsoft exposes for your tenant, list available content, and obtain contentUri values for aggregated time windows, then download each blob so activity records can be normalized in Sophos XDR.
Commercial, GCC, and GCC High tenants follow the same pattern; only the Microsoft API base URL and tenant onboarding differ. Event time in Sophos XDR is driven primarily by each record's CreationTime, as in Microsoft's schema.
Unified audit logging must be turned on in the tenant (it's off by default). Without it, Microsoft does not publish the activity on which this integration relies. See Turn auditing on or off.
What we ingest
We ingest management activity Microsoft returns for your subscribed content types. Each record is represented as Microsoft Office Management telemetry (MICROSOFT_OFFICE_MANAGEMENT in the data lake), scoped to your organization (tenant) identifier. The ingestor retrieves and delivers records to the normalizer; you don't need to define a separate log format for this path.
Activity is deduplicated using Microsoft's event Id (and related tenant context) so repeated deliveries of the same activity within a bounded window don't inflate volume.
Event and data types
We ingest the same event categories that Microsoft publishes to the Management Activity API for your subscriptions. Classification uses Microsoft's RecordType, Workload, Operation, and related fields. The table below is how that activity surfaces in XDR after normalization (grouped for readers; Microsoft's schema is authoritative for exact values).
| Category | Description | Normalized telemetry (examples) |
|---|---|---|
| Entra ID / Azure AD sign-in activity | Sign-in records Microsoft publishes with record types 9 and 15 (for example successful sign-in and sign-in failure patterns in the audit feed). | Authentication and cloud audit |
| General Microsoft 365 audit | Other supported audit record types: admin and user operations across Exchange, SharePoint, Teams, Azure AD directory audits, DLP-related feeds you have subscribed to, and similar—subject to what Microsoft emits and your subscriptions include. | Cloud audit |
| Microsoft Defender / Threat intelligence (mail and URL context) | Records where Workload is ThreatIntelligence: safe links, URL click telemetry, explorer-style security events, and related operations Microsoft groups under that workload. | Third-party security alert and cloud audit; for Operation TIMailData, also email |
| Advanced malware detections in Threat intelligence | Threat intelligence events whose detection method indicates anti-malware style content (and that are not the dedicated TIMailData mail-security record shape), such as ATP / Safe Attachments–style detections (AtpDetection and similar in samples). | Antivirus-style, third-party security alert, and cloud audit |
| Malware found in files (workload audit) | SharePoint / OneDrive / workload operations such as FileMalwareDetected on file objects. | Antivirus-style and cloud audit |
Data provided by this integration
Data provided by the Microsoft 365 Management Activity API gets normalized to the following schemas:
antivirusauthcloudauditemailthirdpartyalert
For more information about using schemas in Data Lake Search, see Schemas and logical types.