Microsoft Graph : I want to optimize AuditLog query which takes long time to complete

Dear @Damien Celle

Welcome to Microsoft Q&A Forum! 

Thank you for raising the concern regarding the long response times when querying audit logs, particularly for SharePoint Online public link sharing via Microsoft Graph API. I’d like to provide some insights and offer practical optimization strategies for you to see if they can help you improve performance. 

Many users have reported similar issues with variable latency when using the Microsoft Graph Audit Log Query API, like in this partially similar case: Logs are ingested with a delay in Graph API - Microsoft Q&A 

This is primarily due to: 

• Asynchronous processing of audit log queries. 
• Ingestion delays that vary depending on workload and tenant size. 
• Throttling limits enforced by Microsoft Graph to protect service resources. 

While Microsoft may not publish a specific SLA for audit log ingestion times, these delays may be expected and documented across community and support channels. 

To help mitigate these delays, here are several practices that I combined with Microsoft documentations, you can try them to see if they were helpful for you: 

1.You can use narrow filters and date ranges to limit your queries using $filter, createdDateTime, and specific operations to reduce processing time. You can see this link: How to analyze activity logs with Microsoft Graph - Microsoft Entra ID | Microsoft Learn 

2.You can try application permissions for background jobs to avoid interactive delays by using AuditLogsQuery.Read.All with application permissions. You can consult: Collect audit logs using Microsoft Graph API - Power Platform | Microsoft Learn 

3.You may consider trying Microsoft Graph Data Connect for bulk access. For large-scale or historical data, Data Connect offers better performance and scalability. Please see this link: Use Microsoft 365 audit logs with Microsoft Graph Data Connect - Microsoft Graph | Microsoft Learn 

4.You may parallelize queries where possible to run multiple audit log jobs concurrently to reduce total wait time. You can consult in here: New-MgBetaSecurityAuditLogQuery (Microsoft.Graph.Beta.Security) | Microsoft Learn 

5.You may try implement Retry Logic and Handle Throttling. Using exponential backoff and respect Retry-After headers to handle throttling gracefully. See this link: Microsoft Graph service-specific throttling limits - Microsoft Graph | Microsoft Learn 

As a Microsoft Q&A moderator, my role is to guide discussions and connect users with helpful resources. While I don’t have the right to access to individual account or your environment in order to help you further. However, I still try my best to support you using the resources available. So, you can consider trying these tips to see if they can help you in some way. 

Besides that, this may be a limitation in this feature, and it significantly impacts your operations, I highly recommend submitting feedback directly to Microsoft via their official portal. This helps prioritize improvements based on customer demand: Microsoft Feedback Portal. The more users report an issue, the higher the chance it gets addressed in future updates. 

I appreciate for your understanding and hope this information can help you in this case. Wish you a pleasant day!

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". 

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.