Before
Analysts had to manually submit audit requests in the audit portal, wait and recheck query status, retrieve the results, and extract relevant fields. They then had to format the activity into a spreadsheet and share the report link with the team through a separate conversation.
How it works
- A Teams-triggered webhook starts the investigation, captures the session filter, and computes the audit boundaries and report title.
- The flow submits the session audit query, waits until processing succeeds, retrieves the records, and keeps the fields needed for investigation.
- It creates and populates a Workbook in the configured location, then posts the completed report link into the initiating Teams conversation.
Workflow details
- Trigger and setup: The workflow starts from a Teams bot command or dispatch action delivered through a webhook. It captures the session-related filter, computes the audit time boundaries, and generates a unique investigation and Workbook title.
- Audit request: It submits an audit query for activity associated with the selected session and repeatedly checks the query status until the results are ready.
- Data curation: Once the audit is complete, the workflow retrieves the records and extracts relevant investigation fields, including creation time, event identifier, operation, event source, user ID, client IP address, browser details, platform, and user agent.
- Report creation: It locates the configured site and drive, creates a Workbook and table, and appends the curated audit events as rows for structured review.
- Team delivery: After obtaining the Workbook URL, it posts an activity report link into the Teams conversation that initiated the investigation, giving analysts direct access to the completed session report.
What changed
The investigation now runs from a Teams command or dispatch action, with query submission, status monitoring, field selection, Workbook creation, and report delivery handled automatically. Analysts receive a consistently structured report link in the same Teams conversation instead of coordinating each handoff manually.
Work removed
Manually submitting audit requests, repeatedly checking query status, retrieving and filtering audit records, copying activity fields into a spreadsheet, creating the report structure, and sending the report link to the team.
Expected outcome
An estimated 15–25 minutes of preparation work is removed per investigation, while each run produces a consistent session-activity report for analyst review.
