Difference between RequestId and ActivityId

[Anonymous]

Hi,

I'm analyzing logs from Office 365 Audit Log to monitor the usage of PowerBI and I'm finding some data that I don't understand at all.

What's the difference betwen RequestId and ActivityId in O365 audit logs?

I'm finding multiple groups of extranges rows where I see:

Same ActivityId

Same CreationTime

Same UserId

Different Id

Different RequestId

Different ReportId (in consequence, different ReportNames)

Has someone some explanation for these kind of rows?

How a unique user can do 4 actions in the same CreationDate for different reports and dashboards?

I have search in the following links but there's no information that could help me:

• https://docs.microsoft.com/es-es/office365/securitycompliance/detailed-properties-in-the-office-365-...
• https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api...
• https://docs.microsoft.com/en-us/office365/securitycompliance/detailed-properties-in-the-office-365-...

Thanks

[MarianoCatalano]

Hi @ruanolin ,

Your article is very old, but can you share any findings about it?

Thank you!

Mariano

[v-yulgu-msft]

Hi @Anonymous ,

Per my understanding, ActivityId represents the type of activity a user made on service, the same activity has the same ActivityId. While each time a user makes an activity would send a new request which leads to a new RequestId.

Regards,

Yuliana Gu

[Anonymous]

Hi @v-yulgu-msft,

When you say the activity type what do you mean exactly?

I'm exporting 2 types of activity, "ViewsReport" and "ViewDashboard", and I'm obtaining this distribution for the ActivitiesId:

Why in some cases we have the same activityID for multiple actions  (ViewReport or ViewDashboard) with different CreationDate and in other cases (1575 cases) I have only one action for activityId?

Thanks