---
title: "Backup Data Browsed"
description: "Sent when a user browses backed-up data. Event ID: vdc.workload_v0.tenant_v0.audit_v0.microsoft.browse_v0 Event message details: Sent with data.audit.action set to Backup Data Browsed. Severity: Info Workloads: Veeam Data Cloud for Microsoft 365"
canonical: "https://helpcenter.veeam.com/docs/vdc/events/vdc_events_backup_data_browsed.html"
breadcrumb: "Event Reference > Backup Data Operations > Backup Data Browsed"
dateModified: "2026-11-02"
---

# Backup Data Browsed

Sent when a user browses backed-up data.

## General Information

**Event ID**: `vdc.workload_v0.tenant_v0.audit_v0.microsoft.browse_v0`

**Event message details**: Sent with `data.audit.action` set to `Backup Data Browsed`.

**Severity**: Info

**Workloads**: Veeam Data Cloud for Microsoft 365

## Parameters

<table class="Blue_Table">
  <tr style="vertical-align:top">
    <th>
      <p>Parameter Name</p>
    </th>
    <th>
      <p>Description</p>
    </th>
    <th>
      <p>Example</p>
    </th>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">specversion</span></p>
    </td>
    <td>
      Event schema version.
    </td>
    <td>
      <p><span class="T_Filenames">ev20260814</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">source</span></p>
    </td>
    <td>
      System that sent the event. Possible values: `CONTROLPLANE`, `M365`, `AZURE`.
    </td>
    <td>
      <p><span class="T_Filenames">M365</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">timestamp</span></p>
    </td>
    <td>
      Time when the event happened, in RFC3339Nano format and the UTC time zone.
    </td>
    <td>
      <p><span class="T_Filenames">2026-08-04T09:18:42Z</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">type</span></p>
    </td>
    <td>
      Event ID.
    </td>
    <td>
      <p><span class="T_Filenames">vdc.workload_v0.tenant_v0.audit_v0.microsoft.browse_v0</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">severity</span></p>
    </td>
    <td>
      Event severity. Possible values: `INFO`, `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`.
    </td>
    <td>
      <p><span class="T_Filenames">INFO</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">visibility</span></p>
    </td>
    <td>
      Intended visibility scope of the event. Only events with the `CUSTOMER_ACCESSIBLE` value are forwarded to SIEM platforms, so a forwarded event always carries this value.
    </td>
    <td>
      <p><span class="T_Filenames">CUSTOMER_ACCESSIBLE</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">category</span></p>
    </td>
    <td>
      Event category. Possible values: `BACKUP`, `RESTORE`, `LOGIN`, `USER_MANAGEMENT`, `TENANT_MANAGEMENT`, `ORGANIZATION_MANAGEMENT`, `SUBSCRIPTION_MANAGEMENT`, `SECURITY_ALERT`, `INTERNAL`.
    </td>
    <td>
      <p><span class="T_Filenames">RESTORE</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">actor.identifier</span></p>
    </td>
    <td>
      Actor identifier.
    </td>
    <td>
      <p><span class="T_Filenames">alice@example.com</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">actor.kind</span></p>
    </td>
    <td>
      Actor type that triggered the event. Possible values: `user`, `system`, `service_account`.
    </td>
    <td>
      <p><span class="T_Filenames">user</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">organizationReference.workloadTenantId</span></p>
    </td>
    <td>
      Workload tenant ID.
    </td>
    <td>
      <p><span class="T_Filenames">tenant_12345</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">orgId</span></p>
    </td>
    <td>
      ID of the Veeam Data Cloud organization that the event belongs to. Resolved during event processing, so it is present even when the event references only a workload tenant.
    </td>
    <td>
      <p><span class="T_Filenames">org_12345</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.audit.action</span></p>
    </td>
    <td>
      <p>Action that represents the event.</p>
    </td>
    <td>
      <p><span class="T_Filenames">Backup Data Browsed</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.audit.actionGroup</span></p>
    </td>
    <td>
      <p>High-level classification of the action category. Possible values: <span class="T_Filenames">DATA_ACCESS</span>, <span class="T_Filenames">ACCESS_MANAGEMENT</span>, <span class="T_Filenames">DATA_MANAGEMENT</span>, <span class="T_Filenames">PROTECTION_MANAGEMENT</span>.</p>
    </td>
    <td>
      <p><span class="T_Filenames">DATA_ACCESS</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.audit.targetDisplayName</span></p>
    </td>
    <td>
      <p>Display name of the target of this event. If the target is unknown or not applicable, the value is <span class="T_Filenames">Unknown</span> or <span class="T_Filenames">N/A</span>.</p>
    </td>
    <td>
      <p><span class="T_Filenames">Inbox</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.browse.application</span></p>
    </td>
    <td>
      <p>Microsoft 365 application that was browsed. Possible values: <span class="T_Filenames">OUTLOOK</span>, <span class="T_Filenames">SHAREPOINT</span>, <span class="T_Filenames">ONEDRIVE</span>, <span class="T_Filenames">TEAMS</span>.</p>
    </td>
    <td>
      <p><span class="T_Filenames">OUTLOOK</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.browse.outlook</span></p>
    </td>
    <td>
      <p>Label for the Outlook (mailbox) data that was browsed. Populated only when <span class="T_Filenames">data.browse.application</span> is <span class="T_Filenames">OUTLOOK</span>.</p>
    </td>
    <td>
      <p><span class="T_Filenames">(browse items) Inbox / Subfolder</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.browse.sharePoint</span></p>
    </td>
    <td>
      <p>Label for the SharePoint data that was browsed. Populated only when <span class="T_Filenames">data.browse.application</span> is <span class="T_Filenames">SHAREPOINT</span>.</p>
    </td>
    <td>
      <p><span class="T_Filenames">(browse sites) Marketing / Documents</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.browse.oneDrive</span></p>
    </td>
    <td>
      <p>Label for the OneDrive data that was browsed. Populated only when <span class="T_Filenames">data.browse.application</span> is <span class="T_Filenames">ONEDRIVE</span>.</p>
    </td>
    <td>
      <p><span class="T_Filenames">(browse files) alice@contoso.com / Documents</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.browse.teams</span></p>
    </td>
    <td>
      <p>Label for the Microsoft Teams data that was browsed. Populated only when <span class="T_Filenames">data.browse.application</span> is <span class="T_Filenames">TEAMS</span>.</p>
    </td>
    <td>
      <p><span class="T_Filenames">(browse channels) Engineering / General</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.tenant.id</span></p>
    </td>
    <td>
      <p>Tenant ID.</p>
    </td>
    <td>
      <p><span class="T_Filenames">tenant_12345</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.workload.type</span></p>
    </td>
    <td>
      <p>Workload type.</p>
    </td>
    <td>
      <p><span class="T_Filenames">M365</span></p>
    </td>
  </tr>
</table>

## Event Example

```json
{
  "specversion": "ev20260814",
  "source": "M365",
  "timestamp": "2026-08-04T09:18:42Z",
  "type": "vdc.workload_v0.tenant_v0.audit_v0.microsoft.browse_v0",
  "severity": "INFO",
  "visibility": "CUSTOMER_ACCESSIBLE",
  "category": "RESTORE",
  "actor": {
    "identifier": "alice@example.com",
    "kind": "user"
  },
  "organizationReference": {
    "workloadTenantId": "tenant_12345"
  },
  "orgId": "org_12345",
  "data": {
    "audit": {
      "action": "Backup Data Browsed",
      "actionGroup": "DATA_ACCESS",
      "targetDisplayName": "Inbox"
    },
    "browse": {
      "application": "OUTLOOK",
      "outlook": {
        "key": "browse.outlook",
        "value": "(browse items) Inbox / Subfolder"
      }
    },
    "tenant": {
      "id": "tenant_12345"
    },
    "workload": {
      "type": "M365"
    }
  }
}
```