O365-API-ResearchOffice 365 Management API:

Please keep in mind that this is a reference for the information that is useful to me, but there is much more available on the google.

Resource Link: MSFT O365 Management API

Microsoft Updates information all of the time so this link could be depricated.

Pre-requisites:

Create a Registered App in Azure AD. Walkthrough found here

Required information for the call:

$ClientID       = "Client ID"  
$ClientSecret   = "Client Secret"  
$TenantGUID     = "Tenant Guid"  
$tenantdomain   = "Tenant Domain"    
$loginURL       = "https://login.microsoftonline.com"
$resource       = "https://graph.windows.net"            # Azure AD Graph API resource URI This will change 

Complete OAuth request for O365 data (example):

$body       = @{grant_type="client_credentials";resource=$resource;client_id=$ClientID;client_secret=$ClientSecret} 
$oauth      = Invoke-RestMethod -Method Post -Uri $loginURL/$tenantdomain/oauth2/token?api-version=1.0 -Body $body 
$headerParams = @{'Authorization'="$($oauth.token_type) $($oauth.access_token)"} 

$url = "https://manage.office.com/api/v1.0/$tenantGUID/activity/feed/subscriptions/list"

$myReport = (Invoke-WebRequest -UseBasicParsing -Headers $headerParams -Uri $url)  

($myReport.Content | ConvertFrom-Json).value

Available Office 365 calls (for the URI field):

Base URL:

https://manage.office.com/api/v1.0/$tenantGUID

(Example of complete URL: https://manage.office.com/api/v1.0/$tenantGUID/activity/feed/subscriptions/content?contentType=Audit.SharePoint)

Display availible office activity feeds:

/activity/feed/subscriptions/list

Display all services:

/ServiceComms/Services

Display all service status:

/ServiceComms/CurrentStatus

Display all service historical status:

/ServiceComms/HistoricalStatus

Display services messages (lots of data):

/ServiceComms/Messages

Display available content for (SharePoint Audit Logs):

Sharepoint Audit Logs: /activity/feed/subscriptions/content?contentType=Audit.SharePoint

(available content types can be found above under "display office activity feeds")

Audit.AzureActiveDirectory
Audit.Exchange
Audit.SharePoint
Audit.General 
DLP.All

Display DLP sensitivity types:

/activity/feed/resources/dlpSensitiveTypes

List notifications (Normally has nothing and based on feed):

/activity/feed/subscriptions/notifications?contentType=Audit.SharePoint

Retrieve content from content Uri (note the single quote instead of the double for the URL):

/activity/feed/audit/20180321155043789031580$20180321155043789031580$audit_sharepoint$Audit_SharePoint