product-example 2 linked patterns checked
Microsoft Learn: Search the audit log
Documents audit-log search jobs, role-gated access, retention, scoped administrative units, result analysis, export, and job deletion behavior.
Read with a purpose
What this source can teach
Use this source to inspect a concrete implementation and the decisions visible in its context.
- Start with the original. Open the source and find the guidance or example relevant to your task.
- Trace the connection. Use the claim notes below to see how this site applies the source to specific patterns.
- Check the setting. Compare the source's platform, people, and constraints with your own decision.
Pattern Decisions This Source Supports
| Pattern | Supported decision | Required contract | Claim note |
|---|---|---|---|
| Activity log | Choose activity log when the task is evidence review, investigation, compliance, security monitoring, or operational troubleshooting. | Each log row identifies one recorded event and keeps actor, action, object, timestamp, and event ID stable across filtering, sorting, expansion, export, and refresh. | Microsoft supports role-gated audit search with scoped access, search jobs, retention, and export behavior. |
| Audit log | Choose audit log when the record must support governed security, compliance, forensic, or administrator-accountability review. | Each audit row represents one governed audit record and keeps audit ID, actor, action, object, effective time, result, and retention metadata stable across filters, details, export, and API retrieval. | Supports audit-log search jobs, result details, export caps, scoped access, and administrative-unit permissions. |
Comparisons supported by this source
- Activity log vs timeline vs notification center vs search history
Microsoft documents role-gated audit search, scoped access, search jobs, retention, and export behavior.
- Audit log vs activity log vs AI output audit trail vs version history vs notification center
Supports audit search jobs, details flyouts, export caps, and scoped administrative access.
Evidence Role
This source is treated as product-example evidence. Its value comes from the specific claims and setting described above.
Publisher: Microsoft Learn. Last checked: .