How can I declare AuditLog.Read.All as a Delegated permission on my Azure AD V2 app?

The documentation for the Microsoft Graph directoryAudits endpoint requires the AuditLog.Read.All as a required permission. It is listed as available for both Delegated and Application permission types.

However, I cannot add AuditLog.Read.All as a Delegated permission to my V2 registered app, either via apps.dev.microsoft.com (it does not show as an option in the Delegated permissions picker), or via the new Application Registrations endpoint in the Azure Portal (it throws an HTTP 400 error when attempting to save after selecting AuditLog.Read.All as a Delegated permission).

How do I register AuditLog.Read.All on my application as a delegated permission so that admin consent flow can be performed?

2 Answers

Find your registered app in the App registrations (preview) in the Azure portal(this is for the v2 app), and then in the API Permission, you could find AuditLog.Read.All in the delegated permission for Microsoft Graph.

After you add and update permissions, you could get this:

For this, you will need to log in an admin account to consent to this permission.

After the admin consents to this, you could find:

It appears that changing signInAudience in the application manifest from AzureADandPersonalMicrosoftAccount to AzureADMultipleOrgs allows the AuditLog.Read.All to properly register.