guid
[a-z0-9]{6}-[a-z0-9]…Account identifier, in the form xxxxxx-xxxxxx-xxxxxx (lowercase letters and digits).
[^@\s]+@[^@\s]+\.[^@…RFC 5322 e-mail address.
country-code
[A-Z]{2}Country code in ISO 3166-1 alpha-2 form (two uppercase letters).
language-tag
[a-z]{2}(-[A-Z]{2})?Language tag per RFC 5646 / BCP 47 (e.g. en, en-US).
phone
\+?[0-9]{4,15}Phone number in E.164 form (optional leading '+', 4-15 digits).
dateTime
\d{4}-\d{2}-\d{2}T\d…ISO 8601 date-time value with timezone offset.
duration
P(\d+Y)?(\d+M)?(\d+D…ISO 8601 duration (e.g. P30D, P1Y, PT24H).
resource-type
Type of a resource.
resource-name
Name of a product resource.
user-type
Type of access token / user account.
connector-type
Type of a cloud connector (device).
acl-name
Name of an API ACL, used when filtering the audit log.
contact-type
Type of account contact: p (primary), e (emergency), f (financial), l (legal).
job-state
Lifecycle state of a job.
audit-area
Event area an audit record belongs to.
report-area
Microsoft 365 workload area covered by a report.
download-type
Archive format of a share download; currently only zip.
device-attribute-name
Name of an attribute configured on a device (connector).
device-health-status
Health status of a device (connector).
token-guid
[a-z0-9]{6}-[a-z0-9]…Access token identifier, in the form xxxxxx-xxxxxx-xxxxxx (lowercase letters and digits).
mail-guid
[a-z0-9]{6}-[a-z0-9]…Identifier of a message in an in-app mailbox, in the form xxxxxx-xxxxxx-xxxxxx (lowercase letters and digits).
message-name
Textual identifier of a message in the message bundle, such as welcome or forgotpass.