A record of changes made in a Microsoft Entra directory, covering things such as user, group, app and licence updates. Entries are held for a week on Entra Free or a month on P1 or P2, and this log is not the same thing as Purview's unified audit log.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Microsoft Entra audit logs in context, with comparison tables and the common traps.
Terms in this definition
- A record
Points a DNS name at an IPv4 address. A typical use is pointing a root (apex) domain at an app.
- Microsoft Entra
The umbrella brand covering Microsoft's identity and network access portfolio. Internet Access, Private Access, External ID and ID Governance all belong to it, built on top of the core directory service, Entra ID.
- Chat message roles
Labels on chat messages: instructions go under system, the person's input under user, the model's previous answers under assistant, and results returned by a called tool under tool (or function).
- App protection policy
A set of Intune rules on managed apps that safeguards organisational data, for example by demanding a PIN or preventing copy-paste and save-as into personal apps. It works whether or not the device is enrolled.
- Licence
What entitles one particular user to the services a subscription offers. Each product licence is made up of several service plans (one per app or service), and before giving it to someone an admin has to record that user's usage location.
- MONTH
A DAX date function giving a date's month as a whole number, where 1 is January and 12 is December.
- Unified audit log
A record of what users and administrators do across numerous Microsoft 365 services, which can be searched with Microsoft Purview Audit. For core services, entries typically become available between one hour and an hour and a half after the activity.