The audit log in Azure AD in super important. If I was an attacker that got access to some tenant, I would make sure my details would not show up in there. I would probably use a VPN/TOR of sorts just to hide my tracks. But what if I tell you that the Microsoft Graph API does already covers your tracks? Not my IP showing in the audit log
