Streaming Microsoft Purview Audit Logs to Event Hub Using Azure Function App

For continuous Microsoft Purview Audit Logs and Microsoft 365 Audit Logs ingestion, the Unified Audit Log is better understood as an authoritative investigation surface than a pipeline source. While Search-UnifiedAuditLog and the Microsoft Graph Audit Search API are pull-based, throttled, and paginated for on-demand searches, sustained collection is better served by the Office 365 Management Activity API. This subscription-based feed is designed for durable ingestion workflows, making it the preferred approach for organizations building scalable compliance and security monitoring solutions with Azure Event Hub and Azure Functions.

Architecture: Five Stages, One Durable Buffer

An Microsoft Entra ID app registration (with ActivityFeed.Read, plus ActivityFeed.ReadDlp for DLP content) authenticates a timer-triggered Azure Function App. The Azure Function polls the /content endpoint on a scheduled interval, retrieves blob URIs, deserializes events, and writes them in batches to Azure Event Hub. This architecture separates data ingestion from downstream processing, allowing services such as Microsoft Sentinel, Azure Data Explorer, or custom storage platforms to consume the data independently.

Polling, rather than webhooks, remains the recommended design for Microsoft Purview Audit Log ingestion. Microsoft has de-emphasized webhook delivery because firewall-blocked notifications trigger exponential back-off, which can eventually disable the webhook. A polling-based Azure Function App removes the need for inbound endpoints, simplifies operations, and provides a more reliable foundation for continuous audit log streaming.

Constraints Shaping Cursor Design

Subscriptions can take up to 12 hours before producing the first content blob. These blobs are not internally ordered, meaning a later blob can contain earlier events. As a result, deduplication is the consumer’s responsibility, using each event’s unique Id as the primary key.

The /content query window is limited to 24 hours and cannot retrieve content older than seven days. Once that retention period expires, unretrieved data cannot be recovered. To prevent duplicates or gaps after an Azure Function App restart, cursor state should always be stored in durable storage such as Azure Table Storage or Blob Storage rather than in application memory.

Common Pipeline Gaps

• ✓Audit.General is frequently overlooked. However, Microsoft Teams, Power Platform, Microsoft Copilot, and Security & Compliance Center events all flow through this content type. Organizations that subscribe only to Audit.SharePoint and Audit.Exchange risk missing a significant portion of their Microsoft Purview Audit Logs.
• ✓Subscriptions can be disabled without notice. Administrative actions or sustained delivery failures may deactivate a subscription without generating downstream errors. Running a health check against the /subscriptions/list endpoint during every execution is the most reliable way to verify that the Office 365 Management Activity API subscription remains active.
• ✓Licensing directly affects throughput. Microsoft Purview Audit Premium (E5/Advanced Audit) provides higher-bandwidth API access, while Standard-licensed tenants handling large audit volumes may experience throttling during peak periods. This limitation should be considered when designing Azure Event Hub ingestion pipelines or committing to strict latency SLAs.