platform-guideline 1 linked patterns checked
Access the Security Copilot audit log
Documents Security Copilot audit logs for admin events, activity metadata, prompt-response pairs, SIEM investigation, Purview DSPM access, permissions, retention, and compliance workflows.
Read with a purpose
What this source can teach
Use this source to understand a platform convention and the setting it was designed for.
- Start with the original. Open the source and find the guidance or example relevant to your task.
- Trace the connection. Use the claim notes below to see how this site applies the source to specific patterns.
- Check the setting. Compare the source's platform, people, and constraints with your own decision.
Pattern Decisions This Source Supports
| Pattern | Supported decision | Required contract | Claim note |
|---|---|---|---|
| AI output audit trail | Choose AI output audit trail when the task is to inspect or prove how a specific AI-generated output was produced, changed, approved, copied, applied, exported, or retained. | Users can open the trail from the generated output, applied object, activity record, or investigation result without losing the answer identity. | Supports prompt-response pairs, activity metadata, admin events, retention, Purview DSPM access, SIEM investigation, and permission requirements. |
Comparisons supported by this source
- AI output audit trail vs activity log vs source grounding display vs confidence uncertainty display vs editable AI output vs regenerate retry vs agent progress trace vs human approval gate
Supports prompt-response pairs, activity metadata, SIEM investigation, permissions, and retention.
Evidence Role
This source is treated as platform-guideline evidence. Its value comes from the specific claims and setting described above.
Publisher: Microsoft Learn. Last checked: .