Exporting audit logs from LCS

(2) Share

Report

Posted on by CU12092249-0

I am wondering if its possible to export LCS audit logs programatically, this mainly concerns logs of user access, logins requests onto the dynamics 365 enviroment. From within LCS, I can see the user activity section on the GUI, there must be a way to access the data and import into Azure.

Categories:

Dynamics 365 Human Resources

Microsoft Dynamics AX

I have the same question (0)

All responses (3)

Answers (1)

Sort by

Suggested answer

Shaluma 375 Super User 2026 Season 2 on at

Like (0)

Report
Copy link

Link copied!

Hi CU12092249-0

Please check this URL, https://community.dynamics.com/blogs/post/?postid=46f5bf52-d82d-4574-ba64-d3e2ecb52a5e

Thanks,
Shaluma

Was this reply helpful? Yes No
Verified answer

Shaluma 375 Super User 2026 Season 2 on at

Like (0)

Report
Copy link

Link copied!
Hi @CU12092249-0

There's no LCS API endpoint for this data, the correct production-grade solution is to bypass LCS entirely and pull the same login telemetry from its actual source: Microsoft Entra ID Sign-In Logs, combined with D365 FO's own UserSessionLog entity via OData.
https://learn.microsoft.com/en-us/purview/audit-search
Azure Portal → Microsoft Entra ID → Monitoring → Diagnostic Settings → Add diagnostic setting, Check SignInLogs Send to ,Log Analytics Workspace and/or Storage Account or Event Hub

Automate export to Azure Storage with Azure Monitor Workbook or Data Export rule In Log Analytics → Tables → Export

OData Entity UserSessionLogV2

D365 FO exposes user session data directly via its OData endpoint. This is the same data underlying the LCS "User Activity" section.

https://<your-d365-environment>.operations.dynamics.com/data/UserSessionLogV2Authentication (Azure AD App Registration), Pull the audit data, Export to Azure Blob Storage. Azure Logic App / Power Automate ,

If you want a scheduled pull without maintaining PowerShell infrastructure, Recurrence (every 24h or weekly before the 7-day LCS window closes), Get Entra ID token (client credentials flow) , https://<env>.operations.dynamics.com/data/UserSessionLogV2?$filter=..., Parse JSON, Create CSV/JSON → Azure Blob Storage or Azure SQL

Thanks,
Shaluma

Was this reply helpful? Yes No
Suggested answer

Anton Venter 21,173 Super User 2026 Season 2 on at

Like (0)

Report
Copy link

Link copied!

@CU12092249-0

I think this is what you are looking for. I did not check exactly what information was available but the user activity should be included.

Monitoring and telemetry overview

https://learn.microsoft.com/en-us/dynamics365/fin-ops-core/dev-itpro/monitoring-telemetry/monitoring-overview

Get started with telemetry for finance and operations apps

https://learn.microsoft.com/en-us/dynamics365/fin-ops-core/dev-itpro/monitoring-telemetry/monitoring-getting-started

Was this reply helpful? Yes No