Audit Logging

What gets logged

Three categories: platform configuration (policy changes, automation edits, dashboard modifications, RBAC updates), governance actions (automation runs, approval decisions, access review outcomes, remediation executions), and user activity (logins, dashboard views, exports). All three feed the same audit pipeline and are exported through the same interface.

Each log entry contains: timestamp (with timezone), actor identity (resolved to Entra ID where possible), action type, target object, before/after state where applicable, source IP, and correlation ID for related events. The schema is consistent across action types so downstream parsing is uniform.

Tamper resistance

Audit log entries are append-only, the API does not expose edit or delete operations for log entries, even to platform administrators. This is the foundational property that makes the log usable as compliance evidence: an auditor needs to know that what they see is what actually happened.

For organizations with strict integrity requirements, the audit log can be streamed continuously to an external SIEM or log management system, creating an off-platform copy that further reduces the risk of in-platform tampering.

Retention

Configurable retention per log category, typically 1-7 years to align with regulation. Logs older than the retention period are archived (compressed, exportable) and eventually purged. The retention policy itself is logged, so changes to retention are auditable.