Before
Administrators likely had to open the Microsoft management portal repeatedly, review or manage subscriptions for each audit category, and renew them before they expired. They also had to coordinate the destination for incoming events and repeat the process across multiple resource types.
How it works
- A scheduled trigger initializes the selected audit categories, destination workflow, tenant context, and one-week expiration time.
- The flow processes each content type by stopping its existing subscription and starting a renewed subscription with the configured destination.
- New audit events are routed to the destination workflow for further analysis, enrichment, notification, or remediation.
Workflow details
- Trigger and configuration: A configured scheduled run invokes the workflow, which defines the audit categories to monitor, the destination workflow for incoming events, the tenant context, and an expiration time set one week ahead.
- Subscription cleanup: The workflow iterates through each selected content type, such as Azure Active Directory, Exchange, SharePoint, general audit events, and DLP, and stops the existing subscription before creating a replacement.
- Subscription renewal: A new subscription is started for each content type with the designated destination workflow and calculated expiration date, ensuring monitoring is renewed for the next period.
- Event delivery: After the subscriptions are active, matching audit events are posted to the registered destination workflow, including the corresponding event information for downstream analysis, enrichment, notification, or remediation.
- Operational result: The process provides recurring coverage for the configured Office 365 audit categories and returns the monitored content types as the successful flow result.
What changed
Subscription renewal is now performed automatically for every configured audit category in one run, with existing subscriptions stopped before replacements are created. Audit events are routed directly to the designated workflow, leaving downstream analysis or remediation to the target flow.
Work removed
Manually opening the management portal, reviewing each audit category, stopping existing subscriptions, starting replacement subscriptions, calculating renewal dates, and configuring the event destination for each monitored content type.
Expected outcome
Each run automates at least 10 recurring subscription operations for the five configured content types—one stop and one restart per category—while maintaining monitoring through the next one-week subscription period.
