Edit

Audit schema for domains in Fabric

Whenever a ___domain is created, edited, or deleted, that activity is recorded in the audit log for Fabric. You can track these activities using Microsoft Purview Audit.

This article explains the information in the Fabric auditing schema that's specific to domains. This information is recorded in the OperationProperties section of the details side pane that opens when you select a ___domain-related activity on the Audit search page.

On the Audit search page:

  1. Search for activities by their operation names.
  2. When the search finishes, select the search to open the search results page.
  3. On the search results page, select one of the search results to open the side pane that displays the record details.

For domains, the ___domain-specific details are found under the OperationProperties section of the side pane, in json format.

Field Type Must appear in the schema Value
OperationName Edm.Enum Yes Activity name as described in the following table.
OperationProperties Edm.Enum Yes Per the properties described in the following table.
Activity flow Activity operation name Properties
Create ___domain/sub-___domain InsertDataDomainAsAdmin operationName:
- InsertDataDomainAsAdmin
operationProperties:
- DataDomainObjectId: <guid>
- DataDomainDisplayName: <string>
- ParentObjectId?: <guid>
Delete ___domain/sub-___domain DeleteDataDomainAsAdmin operationName:
- DeleteDataDomainAsAdmin
operationProperties:
- DataDomainObjectId: <guid>
- DataDomainDisplayName: <string>
- ParentObjectId?: <guid>
Update ___domain/sub-___domain UpdateDataDomainAsAdmin operationName:
- UpdateDataDomainAsAdmin
operationProperties:
- DataDomainObjectId: <guid>
- DataDomainDisplayName: <DataDomainObjectId>
- ParentObjectId?: <guid>
Assign/Unassign workspace to the ___domain UpdateDataDomainFoldersRelationsAsAdmin operationName:
- UpdateDataDomainFoldersRelationsAsAdmin
operationProperties:
- DataDomainObjectId: <guid>
- DataDomainDisplayName: <string>
- ParentObjectId?: <guid>
- FoldersToSetCounter?: <long>
- FoldersToUnsetCount?: <long>
Unassign all workspaces to the ___domain DeleteAllDataDomainFoldersRelationsAsAdmin operationName:
- DeleteAllDataDomainFoldersRelationsAsAdmin
operationProperties:
- DataDomainObjectId: <guid>
- DataDomainDisplayName: <string>
- ParentObjectId?: <guid>
Assign/Unassign workspaces to the ___domain as contributor UpdateDataDomainFoldersRelationsAsContributor operationName:
- UpdateDataDomainFoldersRelationsAsContributor
operationProperties:
- DataDomainObjectId: <guid>
- DataDomainDisplayName: <string>
- ParentObjectId?: <guid>
- FoldersToSetCounter?: <long>
- FoldersToUnsetCount?: <long>
Remove ___domain from workspace settings as workspace owner DeleteDataDomainFolderRelationsAsFolderOwner operationName:
- DeleteDataDomainFoldersRelationsAsFolderOwner
operationProperties:
- DataDomainObjectId: <guid>
- DataDomainDisplayName: <string>
- ParentObjectId?: <guid>
- FolderId?: <long>
Initiate/Process bulk assign ___domain by workspace owners BulkAssignDataDomainByWsOwnersAsAdmin?
Initiate/Process bulk assign ___domain by capacities BulkAssignDataDomainByCapacitiesAsAdmin?
Add/Delete/Update ___domain access UpdateDataDomainAccessAsAdmin operationName:
- UpdateDataDomainAccessAsAdmin
operationProperties:
- DataDomainObjectId: <guid>
- DataDomainDisplayName: <string>
- ParentObjectId?: <guid>
- Value: <long>:
  • 0 - None
  • 7 - Contributor
  • 15 - Admin
- UsersToSetCounter?: <long>
- UsersToUnsetCounter?: <long>
- GroupsToSetCounter?: <long>
- GroupsToUnsetCounter?: <long>
Add/Delete/Update default ___domain UpdateDefaultDataDomainAsAdmin operationName:
- UpdateDefaultDataDomainAsAdmin
operationProperties:
- DataDomainObjectId: <guid>
- DataDomainDisplayName: <string>
- ParentObjectId?: <guid>
- UsersToSetCounter?: <long>
- UsersToUnsetCounter?: <long>
- GroupsToSetCounter?: <long>
- GroupsToUnsetCounter?: <long>
Add/Delete/Update contributors UpdateDataDomainContributorsScopeAsAdmin operationName:
- UpdateDataDomainContributorsScopeAsAdmin
operationProperties:
- DataDomainObjectId: <guid>
- DataDomainDisplayName: <string>
- ParentObjectId?: <guid>
- Value: <long>:
  • 0 - AllTenant
  • 1 - SpecificUsersAndGroups
  • 2 - AdminsOnly
Set/Remove ___domain branding UpdateDataDomainBrandingAsAdmin operationName:
- UpdateDataDomainBrandingAsAdmin
operationProperties:
- DataDomainObjectId: <guid>
- DataDomainDisplayName: <string>
- ParentObjectId?: <guid>
- Value: <long> // Branding ID
Updated delegation at ___domain level UpdateDomainTenantSettingDelegation
Deleted override at ___domain level