Audit Log Retrieval With 30 Day Historical Window And Activity Filtering

via “audit log retrieval with 30-day historical window and activity filtering”

** - A Python MCP server for Microsoft Entra ID (Azure AD) directory, user, group, device, sign-in, and security operations via Microsoft Graph.

Unique: Separates audit logs from sign-in logs as distinct tools, reflecting Entra ID's dual-log architecture where audit logs track administrative changes and sign-in logs track authentication events. Pre-configures 30-day window and activity type filtering to simplify agent queries.

vs others: More comprehensive than sign-in logs because it captures administrative changes; more accessible than Azure Portal audit log viewer because it returns structured JSON suitable for programmatic analysis and alerting.