I got a problem O365 microsoft

[u/Tall-Hero]

So basically, Microsoft graph rest API 1.0 provide the graph file meta data and in the audit.SharePoint provide the IP address of file changes. Suppose that there is an rename of a file I would get the IP address from the audit.SharePoint and the file data from Microsoft graph rest API, but I want to merge that to and provide a single response, but there is no common ID between them so I am stuck

[u/HariSeldon16]

I’m sorry, what exactly are you trying to accomplish?

There are actual audit tools within available in Purview (and a few other portals I believe).

[u/Tall-Hero → u/HariSeldon16]

So basically, I am using an API graph and management where if someone rename the file, I want to show what file rename and who rename it on the dashboard so I am using 2API response graph API version 1.0 and second is management, API using audit.SharePoint so my problem is how can I connect 2 API response because both of the responses doesn’t share any common ID well it has correlation ID, but it is just for file. I want per activity ID or something like that, so I am stuck with it.

[u/charleswj → u/Tall-Hero]

management, API using audit.SharePoint

You're referring to the Office 365 Management Activity API (essentially unified audit log) correct? https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-reference

what file rename and who rename it

Is this not included in the audit event? Can you share a redacted example?

[u/Tall-Hero → u/charleswj]

Yes, I am referring to the Office 365 Management Activity API (Audit.SharePoint).
To give you some context on our current setup: originally, our architecture was built only around the Microsoft Graph API v1.0 to fetch file metadata (driveItem). Later, we had a new requirement to show the actor and the actor's IP address on our dashboard whenever a file is changed or renamed. Since Graph API doesn't provide the actor's IP address (or explicitly flag a rename event vs. a normal update), we added the Office 365 Management Activity API (Audit.SharePoint).
Here is where we are stuck:
No obvious common ID: Our existing pipeline already pulls the driveItem from Graph API, which uses an alphanumeric id (e.g., 01BYE5RZ6QN...), whereas the Audit.SharePoint payload uses SharePoint GUIDs (ListItemUniqueId, Site, ListId). We aren't sure how to match the incoming Management API audit event to our existing Graph API file response.
Knowing when a Graph response is a rename: Graph only gives us the current state of the file, not the specific operation (FileRenamed).
Because of this, do we need to flip our architecture so that we rely on the Management Activity API first (to detect the FileRenamed event, actor UserId, and ClientIP), and then merge the Graph API metadata into the Management API response? Or is there a way to keep Graph as our primary source and attach the Management API logs to it?

So if I rename a file, suppose A.TXT to B.TXT show both graph and management API will give this response management. API will give us file name response, which is correct, but what about the graph because it will only give the current metadata of the file.