2.2 Auditing Configuration & Log Management
Key Takeaways
- Dataverse auditing follows a strict 3-tier hierarchical structure: Environment (Organization) level, Table level, and Column level.
- Auditing will not track field-level changes unless auditing is enabled at BOTH the Environment level AND the specific Table level, with the individual Column auditing flag set.
- Audited operations encompass record Create, Update (old vs. new values), Delete, Share, Assign, Associate/Disassociate, security role assignments, and user logon access.
- Audit logs consume the Dataverse 'Log' capacity tier and are stored in quarterly SQL database partitions.
- Administrators manage log capacity in PPAC by defining audit retention policies or deleting historical quarterly audit partitions up to a specified cutoff date.
Auditing Configuration & Log Management
Enterprise organizations operating in regulated industries (healthcare, finance, government) must maintain strict traceability of data modifications, security role assignments, and user access patterns. In Microsoft Dataverse, Auditing provides an immutable, chronological record of transactions. For the PL-200 exam, functional consultants must understand how to configure the 3-tier auditing hierarchy, interpret audit logs, manage log storage capacity, and execute partition deletions.
1. The 3-Tier Auditing Hierarchy
Auditing in Dataverse operates as an inheritance model. If a higher tier is disabled, subordinate tiers cannot generate audit entries.
+-----------------------------------------------------------------------------------+
| 3-TIER AUDITING HIERARCHY MODEL |
| |
| [TIER 1: ENVIRONMENT / ORG LEVEL] (PPAC / Environment Settings) |
| - Start Auditing: [Enabled] |
| - Log user access: [Optional] |
| - Read audit: [Optional] |
| | |
| | (Must be ON for any auditing to occur) |
| v |
| [TIER 2: TABLE LEVEL] (Table Properties / Advanced Options) |
| - Audit changes to its data: [Enabled] |
| | |
| | (Must be ON for table operations & columns to be audited)|
| v |
| [TIER 3: COLUMN LEVEL] (Column Properties / Advanced Options) |
| - Enable auditing: [Enabled] (Default is Enabled on most standard columns) |
| (Tracks specific attribute changes: Old Value ---> New Value) |
+-----------------------------------------------------------------------------------+
Auditing Tier Configuration Matrix
| Level | Where Configured | Setting Name | Effect When Disabled |
|---|---|---|---|
| Tier 1: Environment | PPAC > Environment > Settings > Audit settings | Start Auditing | No audit records of any kind are written across the entire environment. |
| Tier 2: Table | Maker Portal > Table Properties > Advanced options | Audit changes to its data | No create, update, delete, or share events are tracked for this table, regardless of column settings. |
| Tier 3: Column | Maker Portal > Column Properties > Advanced options | Enable auditing | Changes to this specific column are ignored; table-level create/delete events still record. |
[!IMPORTANT] Rule of Auditing Inheritance: For a specific column modification to appear in the audit trail, auditing MUST be enabled at Tier 1 (Environment), Tier 2 (Table), and Tier 3 (Column). If any layer in the chain is turned off, column value changes will not be logged.
2. Tracked Events & Auditing Capabilities
Dataverse captures a comprehensive array of data modification, relationship, and administrative security events.
+-----------------------------------------------------------------------------------+
| DATAVERSE AUDITED EVENT SPECTRUM |
| |
| [DATA OPERATIONS] [SECURITY & ACCESS] [RELATIONSHIPS] |
| - Create Record - User Logon Access - Associate (N:N, 1:N) |
| - Update Field (Old->New) - Security Role Assigned - Disassociate |
| - Delete Record - Security Role Removed - Assign (Change Owner) |
| - Read / Export View - Business Unit Move - Share / Modify Rights |
+-----------------------------------------------------------------------------------+
Breakdown of Tracked Operations
- Record Lifecycle Events:
- Create: Logs the timestamp, creating user, and initial values.
- Update: Captures the exact Old Value and New Value for every audited column changed during the transaction.
- Delete: Records the deletion timestamp, user, and the primary name/GUID of the deleted record.
- Security & Governance Events:
- User Access Logging: Tracks when users log into the Dataverse environment (via Web, Outlook, Mobile, or API).
- Security Role Changes: Tracks granting or revoking security roles to users or teams.
- Business Unit Reassignment: Records when users or records move between business units.
- Collaboration & Relationship Events:
- Sharing & Rights: Records when a record is shared with users/teams and what specific privileges (Read, Write, Delete, Append) were granted or revoked.
- Assign: Tracks changes in record ownership from one user/team to another.
- Associate / Disassociate: Tracks linking or unlinking records across many-to-many (N:N) or one-to-many (1:N) relationships.
3. Reviewing Audit Trails
Dataverse provides two primary interfaces for inspecting audit data:
+-----------------------------------------------------------------------------------+
| AUDIT DATA VIEWING INTERFACES |
| |
| +-------------------------------------+ +------------------------------------+ |
| | RECORD AUDIT HISTORY TAB | | AUDIT SUMMARY VIEW | |
| | (Model-Driven Form > Related > Audit)| | (PPAC / Environment Settings) | |
| | | | | |
| | - Single-record timeline view | | - Global system-wide audit stream | |
| | - Field-by-field delta display | | - Filter by Entity, User, Event | |
| | - Shows Old Value vs. New Value | | - Exportable for compliance review | |
| +-------------------------------------+ +------------------------------------+ |
+-----------------------------------------------------------------------------------+
Sample Record Audit Entry Structure
| Changed Date | Changed By | Event | Changed Field | Old Value | New Value |
|---|---|---|---|---|---|
| 2026-08-17 09:15 AM | Sarah Davis | Update | Credit Limit | $50,000 | $100,000 |
| 2026-08-17 09:15 AM | Sarah Davis | Update | Payment Terms | Net 30 | Net 60 |
| 2026-08-14 02:30 PM | Alex Brown | Assign | Owner | Alex Brown | Enterprise Sales Team |
| 2026-08-10 11:00 AM | System | Create | Account Name | null | Fabrikam Technologies |
4. Log Storage Governance, Retention & Partition Deletion
Audit records are stored in the Dataverse Log Storage Tier (distinct from Database and File storage tiers). Because high-volume transactional tables can rapidly generate gigabytes of audit records, administrators must implement active log governance.
+-----------------------------------------------------------------------------------+
| AUDIT PARTITIONING & DELETION TIMELINE |
| |
| [Q1-2025 Partition] [Q2-2025 Partition] [Q3-2025 Partition] [Q4-2025 (ACTIVE)] |
| (Closed) (Closed) (Closed) (Open / Writing)|
| =================== =================== =================== ===================|
| [ DELETE CANDIDATE ] [ DELETE CANDIDATE ] [ DELETE CANDIDATE ] [ CANNOT DELETE ] |
| <--------------------------------------- |
| Admin can delete partitions up to a selected cutoff date |
+-----------------------------------------------------------------------------------+
Audit Log Retention Policies
In the Power Platform Admin Center, administrators can configure automated Audit Retention Policies:
- Navigate to PPAC > Environment > Settings > Audit settings.
- Under Retain these logs for, choose a retention window:
30 days,90 days,180 days,1 year,Custom, orForever.
- Dataverse automatically purges audit partitions that exceed the configured retention horizon.
Quarterly Audit Partition Management
Dataverse divides audit storage into quarterly chronological database partitions (e.g., Q1, Q2, Q3, Q4 of each calendar year).
[!CAUTION] Partition Deletion Rules:
- You can delete historical, closed audit partitions to reclaim Log capacity.
- You CANNOT delete the current active partition (the partition currently receiving live transaction logs).
- Deleting an audit partition removes all audit entries across all tables within that quarterly timeframe permanently. This action is irreversible.
A healthcare provider requires strict auditing on patient address changes. The functional consultant enables 'Start Auditing' in the Environment Settings in PPAC and verifies that 'Enable auditing' is checked on the 'Street Address' column in the Patient table. However, when users update patient addresses, no entries appear in the Audit History. What configuration step was missed?
An enterprise company is running low on Dataverse 'Log' storage capacity due to several years of high-volume audit logs. The compliance officer approves deleting audit records older than 18 months. How should the system administrator accomplish this in the Power Platform Admin Center?
Which of the following operations CANNOT be tracked by native Dataverse auditing?
An administrator attempts to delete the most recent audit log partition covering the current ongoing quarter to free up urgent capacity. What will occur?