Retrieve SharePoint Online change log for entire tenant

Question

I'm using GetChanges REST end point to retrieve SP change log:

https://mytenant.sharepoint.com/_api/site/GetChanges

with request body like below:

{
    "query": {
        "Add": true,
        "ChangeTokenStart": {
                "StringValue": "1;1;46980cf5-3dbe-4f4c-8ed4-8a42074abd6d;0;-1"
            }
   }
}

It returns change records for the specified site collection and it's subsites.

As I know change token "1;1;46980cf5-3dbe-4f4c-8ed4-8a42074abd6d;0;-1" format is:

• Version number;
• A number indicating the change scope: 0 – Content Database, 1 – site collection, 2 – site, 3 – list;
• GUID representing the scope ID of the change token (in my example it's: 46980cf5-3dbe-4f4c-8ed4-8a42074abd6d);
• Time (in UTC) when the change occurred;
• Number of the change relative to other changes;

The problem is - I have a lot of site collection (>100) in my tenant. So it takes a lot of requests to retrieve changes for all of them.

The question is:

Is it possible to get all changes for entire tenant (for all site collections) using scope: 0 – Content Database?

When I'm trying to use scope = 0 for ChangeTokenStart parameter "1;0;46980cf5-3dbe-4f4c-8ed4-8a42074abd6d;0;-1" I'm getting error like: "Cannot use the changeToken from one object against a different object."

Any help how to to find out proper Guid for content database to use for scope=0 GetChanges request.

Both Get-SPDatabase or Get-SPContentDatabase PowerShell cmdlets or analogs are not provided in Sharepoint PnP-PowerShell or SharePoint Online Management Shell (looks like deprecated).

Answer 1

No, the endpoint https://{site_url}/_api/site can only access a specific site collection. It cannot access other site collections, so it's not possible to get changes for all site collections in SharePoint rest api.

Besides, the content base is in the back-end managed by microsoft, and we could not get any information in the backend.

For your requirments, I would suggest you use adudit log search in Office 365 Security & Compliance to retrieve log for entire tenant: https://docs.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance?view=o365-worldwide