New feature
Beta
Microsoft 365 Unified Audit Logs connector
Microsoft 365 Unified Audit Logs connector is a Databricks data engineering capability, introduced September 2026.
A managed Lakeflow Connect connector that ingests unified audit events from Microsoft Entra ID, Exchange, SharePoint and other Microsoft 365 workloads into Databricks.
- It reads the audit trail, not the mail: the connector explicitly does not ingest Outlook messages or SharePoint files, only who did what to them.
- Five source tables come out of it - Entra ID, Exchange, SharePoint, general and data loss prevention audit events.
- Setup says to give the Entra client secret a 24-month expiry, so the pipeline comes with a built-in two-year reminder to rotate it.
Limitations: Beta, enabled by a workspace admin from the Previews page. API and bundle authoring only (no UI), OAuth M2M only, no row filtering, no SCD type 2 (events are append-only), and no data type changes under schema evolution.
Open in REbricked →- Category
- Data engineering
- Also known as
- Microsoft 365 Unified Audit Logs, M365 audit logs connector, Office 365 audit logs
- Verified
- 2026-10-20