product-example checked
Microsoft Learn: Search the audit log
Documents audit-log search jobs, role-gated access, retention, scoped administrative units, result analysis, export, and job deletion behavior.
Pattern Decisions This Source Supports
| Pattern | Supported decision | Required contract | Claim note |
|---|---|---|---|
| Activity log | Choose activity log when the task is evidence review, investigation, compliance, security monitoring, or operational troubleshooting. | Each log row identifies one recorded event and keeps actor, action, object, timestamp, and event ID stable across filtering, sorting, expansion, export, and refresh. | Microsoft supports role-gated audit search with scoped access, search jobs, retention, and export behavior. |
| Audit log | Choose audit log when the record must support governed security, compliance, forensic, or administrator-accountability review. | Each audit row represents one governed audit record and keeps audit ID, actor, action, object, effective time, result, and retention metadata stable across filters, details, export, and API retrieval. | Supports audit-log search jobs, result details, export caps, scoped access, and administrative-unit permissions. |
Evidence Role
This source is treated as product-example evidence. Use it to validate the decision rules above, not as a visual style reference.
Publisher: Microsoft Learn. Last checked: .