Actions467
- Alert Actions
- Application Actions
- Add Chocolatey App
- Add MSP App
- Add Multi-Tenant App
- Add Office App
- Add Store App
- Add Win32 Script App
- Add WinGet App
- Assign
- Create App Template
- Delete App Approval Template
- Exclude Licenses
- Get App Approval
- Get Many
- Get Queue
- List App Approval Templates
- List App IDs
- List Apps Repository
- List Excluded Licenses
- List Potential Apps
- Patch Application
- Remove
- Remove From Queue
- Sync VPP
- Trigger App Upload
- Autopilot Actions
- Backup Actions
- CIPP Admin Actions
- Create SAM App
- Get Extension Cache Data
- Get Extension Mapping
- Get Extensions Config
- Get NinjaOne Queue
- List Extension Alerts
- List Extension Sync
- List Pending Webhooks
- Manage Partner Webhook
- Refresh CPV (All Tenants)
- Refresh CPV Permissions
- Run Combined Setup
- Run SAM Setup
- Set Backup Retention
- Set Branding
- Set DNS Config
- Set Extensions Config
- Set JIT Admin Settings
- Set Log Retention
- Set Notification Config
- Set Password Config
- Set Time Settings
- Sync Extension
- Test Extension
- CIPP Core Actions
- Conditional Access Actions
- Contact Actions
- Device Actions
- Exchange Resource Actions
- GDAP Actions
- Group Actions
- Identity Actions
- Mailbox Actions
- Add Shared Mailbox
- Convert
- Create High Volume Email
- Edit Calendar Permissions
- Edit Mailbox Permissions
- Enable Archive
- Enable Auto-Expand Archive
- Hide From GAL
- List Calendar Permissions
- List Global Address List
- List Mailbox Client Access Settings
- List Mailbox Permissions
- List Mailbox Restores
- List Mailbox Rules
- List Mailboxes
- List Message Trace
- List Mobile Devices
- List Out of Office
- List Restricted Users
- List Shared Mailbox Account Enabled
- List Shared Mailbox Statistics
- Manage Mobile Device
- Manage Retention Policies
- Manage Retention Tags
- Remove Mailbox Rule
- Remove Restricted User
- Repair Exchange Role
- Restore Mailbox
- Run Exchange Request
- Send Org Message
- Set Calendar Processing
- Set Copy for Sent
- Set Default Calendar Permissions
- Set Default Contact Permissions
- Set Default Mailbox Permissions
- Set Email Forwarding
- Set Email Size
- Set Litigation Hold
- Set Locale
- Set Mailbox Quota
- Set Mailbox Retention Policies
- Set Mailbox Rule
- Set Out of Office
- Set Recipient Limits
- Set Retention Hold
- Start Managed Folder Assistant
- OneDrive Actions
- Policy Actions
- Add
- Add Assignment Filter
- Add Assignment Filter Template
- Add Defender Deployment
- Add Intune Template
- Add Reusable Setting
- Add Reusable Setting Template
- Assign
- Delete Assignment Filter
- Edit Assignment Filter
- Edit Intune Policy
- Edit Intune Script
- Edit Policy
- Exec Device Passcode Action
- Get Many
- List App Protection Policies
- List Assignment Filter Templates
- List Assignment Filters
- List Compliance Policies
- List Defender State
- List Defender TVM
- List Intune Intents
- List Intune Scripts
- List Intune Templates
- List Reusable Setting Templates
- List Reusable Settings
- Remove
- Remove Assignment Filter Template
- Remove Intune Script
- Remove Intune Template
- Remove Reusable Setting
- Remove Reusable Setting Template
- Quarantine Actions
- Safe Link Actions
- Scheduled Item Actions
- Spam Filter Actions
- Add Quarantine Policy
- Add Spam Filter
- Add Spam Filter Template
- Add Tenant Allow/Block List Entry
- Edit Anti-Phishing Filter
- Edit Malware Filter
- Edit Quarantine Policy
- Edit Safe Attachments Filter
- Edit Spam Filter
- List Anti-Phishing Filters
- List Malware Filters
- List Quarantine Policies
- List Safe Attachments Filters
- List Spam Filter Templates
- List Spam Filters
- Remove Spam Filter
- Remove Spam Filter Template
- Standard Actions
- Add BPA Template
- Add Standards Template
- Clone Drift
- Compare Standards
- Convert Standards
- Deploy Standards
- Get Domain Health
- List BPA Reports
- List BPA Results
- List BPA Templates
- List Domain Analyser
- List Standard Templates
- List Standards
- List Tenant Alignment
- List Tenant Drift
- Remove BPA Template
- Remove Standard
- Remove Standard Template
- Run All Standards
- Run BPA
- Run Domain Analyser
- Run Standards
- Update Drift Deviation
- Team Actions
- Teams Shift Actions
- Approve Offer Shift Request
- Approve Swap Shift Request
- Approve Time Off Request
- Create Offer Shift Request
- Create Open Shift
- Create Scheduling Group
- Create Shift
- Create Swap Shift Request
- Create Time Off Reason
- Create Time Off Request
- Decline Offer Shift Request
- Decline Swap Shift Request
- Decline Time Off Request
- Delete Open Shift
- Delete Scheduling Group
- Delete Shift
- Delete Time Off Reason
- List Offer Shift Requests
- List Open Shifts
- List Scheduling Groups
- List Shifts
- List Swap Shift Requests
- List Time Off Reasons
- List Time Off Requests
- Update Open Shift
- Update Scheduling Group
- Update Shift
- Update Time Off Reason
- Tenant Actions
- Add
- Add Domain
- Add SPN
- Add Tenant (by Token)
- Clear Cache
- CSP License Action (Sherweb)
- Delete Tenant Group
- Edit
- Edit Offboarding Defaults
- Exclude Tenant
- Get CSP Licenses (Sherweb)
- Get Details
- Get Licenses
- Get Many
- Get Offboarding Job
- Get Secure Score
- List Admin Portal Licenses
- List App Consent Requests
- List CSP SKUs (Sherweb)
- List Defender State
- List Domains
- List OAuth Apps
- List Service Health
- List Service Principals
- List Tenant Allow/Block List
- List Tenant Groups
- List Tenant Onboarding
- Offboard
- Onboard
- Remove Allow/Block Entry
- Remove Capabilities Cache
- Remove Domain
- Remove Tenant
- Run Access Checks
- Run Tenant Group Rule
- Set Auth Method
- Update Secure Score
- Tool Actions
- Transport Actions
- Add Connection Filter
- Add Connection Filter Template
- Add Connector
- Add Connector Template
- Add or Edit Rule
- Add Rule
- Add Rule Template
- Edit Connector
- Edit Rule
- List Connection Filter Templates
- List Connection Filters
- List Connector Templates
- List Connectors
- List Rule Templates
- List Rules
- Remove Connector
- Remove Connector Template
- Remove Rule
- Remove Rule Template
- User Actions
- Add
- Add Guest
- Add JIT Template
- Add User Defaults
- Add Users (Bulk)
- BEC Check
- BEC Remediate
- Clear Immutable ID
- Create TAP
- Disable
- Dismiss Risky User
- Edit
- Edit JIT Template
- Edit User Aliases
- Enable
- Execute JIT Admin
- Get Many
- List Inactive Accounts
- List JIT Admin
- List JIT Templates
- List MFA Users
- List New User Defaults
- List Per-User MFA
- List Sign-Ins
- List Trusted/Blocked Senders
- List User CA Policies
- List User Counts
- List User Devices
- List User Groups
- List User Mailbox Details
- List User Mailbox Rules
- List User Photo
- List User Settings
- List User Sign-In Logs
- List Users
- Offboard
- Patch User
- Remove
- Remove JIT Template
- Remove Trusted/Blocked Sender
- Remove User Default Template
- Reprocess Licenses
- Reset MFA
- Reset Password
- Revoke Sessions
- Send MFA Push
- Set Password Never Expires
- Set Per-User MFA
- Set User Photo
- Trigger Bulk License
- Voice Actions
- Workflow Actions
Alert → Search Audit Log
AI-generatedSummary
Searches a tenant’s audit log using the supplied filters or retrieves results for an existing search ID. Returns the CIPP API response, with an optional recursive conversion of plain numeric strings to numbers.
Inputs
- Tenant (required) — Select a tenant from the list or enter its domain.
- Search Fields — Optional filters: Action, Start Time and End Time (ISO 8601), PS Object, or Search ID. Search ID retrieves results for an existing search.
- Normalize Numeric Strings — Defaults to false. When enabled, converts plain decimal numeric strings in the response—including nested values—to numbers; other strings are left unchanged.
Output shape
The CIPP API response for the audit log search, returned as n8n item data.
The source pack does not expose the operation’s response unwrapping or output shaping, so the exact response structure is not specified.