---
title: "Backup Data Searched"
description: "Sent when a user searches backed-up data. Event ID: vdc.workload_v0.tenant_v0.audit_v0.microsoft.search_v0 Event message details: Sent with data.audit.action set to Backup Data Searched. Severity: Info Workloads: Veeam Data Cloud for Microsoft 365"
canonical: "https://helpcenter.veeam.com/docs/vdc/events/vdc_events_backup_data_searched.html"
breadcrumb: "Event Reference > Backup Data Operations > Backup Data Searched"
dateModified: "2026-11-02"
---

# Backup Data Searched

Sent when a user searches backed-up data.

## General Information

**Event ID**: `vdc.workload_v0.tenant_v0.audit_v0.microsoft.search_v0`

**Event message details**: Sent with `data.audit.action` set to `Backup Data Searched`.

**Severity**: Info

**Workloads**: Veeam Data Cloud for Microsoft 365

## Parameters

<table class="Blue_Table">
  <tr style="vertical-align:top">
    <th>
      <p>Parameter Name</p>
    </th>
    <th>
      <p>Description</p>
    </th>
    <th>
      <p>Example</p>
    </th>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">specversion</span></p>
    </td>
    <td>
      Event schema version.
    </td>
    <td>
      <p><span class="T_Filenames">ev20260814</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">source</span></p>
    </td>
    <td>
      System that sent the event. Possible values: `CONTROLPLANE`, `M365`, `AZURE`.
    </td>
    <td>
      <p><span class="T_Filenames">M365</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">timestamp</span></p>
    </td>
    <td>
      Time when the event happened, in RFC3339Nano format and the UTC time zone.
    </td>
    <td>
      <p><span class="T_Filenames">2026-08-04T09:18:42Z</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">type</span></p>
    </td>
    <td>
      Event ID.
    </td>
    <td>
      <p><span class="T_Filenames">vdc.workload_v0.tenant_v0.audit_v0.microsoft.search_v0</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">severity</span></p>
    </td>
    <td>
      Event severity. Possible values: `INFO`, `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`.
    </td>
    <td>
      <p><span class="T_Filenames">INFO</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">visibility</span></p>
    </td>
    <td>
      Intended visibility scope of the event. Only events with the `CUSTOMER_ACCESSIBLE` value are forwarded to SIEM platforms, so a forwarded event always carries this value.
    </td>
    <td>
      <p><span class="T_Filenames">CUSTOMER_ACCESSIBLE</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">category</span></p>
    </td>
    <td>
      Event category. Possible values: `BACKUP`, `RESTORE`, `LOGIN`, `USER_MANAGEMENT`, `TENANT_MANAGEMENT`, `ORGANIZATION_MANAGEMENT`, `SUBSCRIPTION_MANAGEMENT`, `SECURITY_ALERT`, `INTERNAL`.
    </td>
    <td>
      <p><span class="T_Filenames">RESTORE</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">actor.identifier</span></p>
    </td>
    <td>
      Actor identifier.
    </td>
    <td>
      <p><span class="T_Filenames">alice@example.com</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">actor.kind</span></p>
    </td>
    <td>
      Actor type that triggered the event. Possible values: `user`, `system`, `service_account`.
    </td>
    <td>
      <p><span class="T_Filenames">user</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">organizationReference.workloadTenantId</span></p>
    </td>
    <td>
      Workload tenant ID.
    </td>
    <td>
      <p><span class="T_Filenames">tenant_12345</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">orgId</span></p>
    </td>
    <td>
      ID of the Veeam Data Cloud organization that the event belongs to. Resolved during event processing, so it is present even when the event references only a workload tenant.
    </td>
    <td>
      <p><span class="T_Filenames">org_12345</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.audit.action</span></p>
    </td>
    <td>
      <p>Action that represents the event.</p>
    </td>
    <td>
      <p><span class="T_Filenames">Backup Data Searched</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.audit.actionGroup</span></p>
    </td>
    <td>
      <p>High-level classification of the action category. Possible values: <span class="T_Filenames">DATA_ACCESS</span>, <span class="T_Filenames">ACCESS_MANAGEMENT</span>, <span class="T_Filenames">DATA_MANAGEMENT</span>, <span class="T_Filenames">PROTECTION_MANAGEMENT</span>.</p>
    </td>
    <td>
      <p><span class="T_Filenames">DATA_ACCESS</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.audit.targetDisplayName</span></p>
    </td>
    <td>
      <p>Display name of the target of this event. If the target is unknown or not applicable, the value is <span class="T_Filenames">Unknown</span> or <span class="T_Filenames">N/A</span>.</p>
    </td>
    <td>
      <p><span class="T_Filenames">alice@contoso.com</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.search.application</span></p>
    </td>
    <td>
      <p>Microsoft 365 application that the search was scoped to. Possible values: <span class="T_Filenames">OUTLOOK</span>, <span class="T_Filenames">SHAREPOINT</span>, <span class="T_Filenames">ONEDRIVE</span>, <span class="T_Filenames">TEAMS</span>.</p>
    </td>
    <td>
      <p><span class="T_Filenames">OUTLOOK</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.search.target</span></p>
    </td>
    <td>
      <p>Display name of the searched scope or the root, for example a mailbox name or a SharePoint site title.</p>
    </td>
    <td>
      <p><span class="T_Filenames">alice@contoso.com</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.search.searchValue</span></p>
    </td>
    <td>
      <p>Free-text search query entered by the user. Populated only for basic searches.</p>
    </td>
    <td>
      <p><span class="T_Filenames">Q4 budget</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.search.restorePoint</span></p>
    </td>
    <td>
      <p>Restore point the search was run against, as an ISO-8601 UTC timestamp.</p>
    </td>
    <td>
      <p><span class="T_Filenames">2025-09-18T14:33:20Z</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.search.criteria[].field</span></p>
    </td>
    <td>
      <p>Label of the searched field, for example <span class="T_Filenames">Subject</span> or <span class="T_Filenames">From</span>.</p>
    </td>
    <td>
      <p><span class="T_Filenames">Subject</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.search.criteria[].condition</span></p>
    </td>
    <td>
      <p>Condition operator. Possible values: <span class="T_Filenames">Equal</span>, <span class="T_Filenames">NotEqual</span>, <span class="T_Filenames">Contains</span>, <span class="T_Filenames">NotContain</span>.</p>
    </td>
    <td>
      <p><span class="T_Filenames">Equal</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.search.criteria[].value</span></p>
    </td>
    <td>
      <p>Condition value.</p>
    </td>
    <td>
      <p><span class="T_Filenames">Q4 budget</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.tenant.id</span></p>
    </td>
    <td>
      <p>Tenant ID.</p>
    </td>
    <td>
      <p><span class="T_Filenames">tenant_12345</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.workload.type</span></p>
    </td>
    <td>
      <p>Workload type.</p>
    </td>
    <td>
      <p><span class="T_Filenames">M365</span></p>
    </td>
  </tr>
</table>

## Event Example

```json
{
  "specversion": "ev20260814",
  "source": "M365",
  "timestamp": "2026-08-04T09:18:42Z",
  "type": "vdc.workload_v0.tenant_v0.audit_v0.microsoft.search_v0",
  "severity": "INFO",
  "visibility": "CUSTOMER_ACCESSIBLE",
  "category": "RESTORE",
  "actor": {
    "identifier": "alice@example.com",
    "kind": "user"
  },
  "organizationReference": {
    "workloadTenantId": "tenant_12345"
  },
  "orgId": "org_12345",
  "data": {
    "audit": {
      "action": "Backup Data Searched",
      "actionGroup": "DATA_ACCESS",
      "targetDisplayName": "alice@contoso.com"
    },
    "search": {
      "application": "OUTLOOK",
      "target": "alice@contoso.com",
      "searchValue": "Q4 budget",
      "restorePoint": "2025-09-18T14:33:20Z"
    },
    "tenant": {
      "id": "tenant_12345"
    },
    "workload": {
      "type": "M365"
    }
  }
}
```