Manage Dataverse auditing

The Dataverse auditing feature is designed to meet the external and internal auditing, compliance, security, and governance policies that are common to many enterprises. Dataverse auditing logs changes that are made to customer records in an environment with a Dataverse database. Dataverse auditing also logs user access through an app or through the SDK in an environment.

Dataverse auditing is supported on all custom and most customizable tables and columns. Audit logs are stored in Dataverse and consume log storage capacity. Audit logs can be viewed in the Audit History tab for a single record and in the Audit Summary view for all audited operations in a single environment. Audit logs can also be retrieved using the web API or the SDK for .NET. Audit logs are created when there are changes to the record on a table where auditing is turned on. Audit logs for updates are created when a new value is different from the old value of a column.

Audit History for a single record

Audit Summary view (all audit logs)

Audit logs help administrators and other privileged users to answer questions like:

• Who created or updated a record and when?
• Which fields in a record were updated?
• What was the previous field value before the update?
• Who was accessing the system and when?
• Who deleted a record?

The following operations can be audited:

• Audit changes at the entity, attribute, and organization level. For example, enabling audit for an environment or a table.
• Create, update, and delete operations on records.
• Changes to the sharing privileges of a record.
• The N:N association or disassociation of records.
• Changes to security roles.
• Deletion of audit logs.
• For changes made to entity fields that can be localized, such as the Product entity name or description fields, the locale ID (LCID) appears in the audit record.

Auditing is not supported on table or column definition changes or during authentication. Furthermore, auditing does not support retrieve operations or export operations. Dataverse and model-driven apps activity logging can be turned on, in addition to Dataverse auditing, to log data retrieve operations and export operations.

The following list enumerates the non-customizable tables that cannot be audited. This list was obtained by testing for a CanModifyAuditSettings column value of false on each table's definition:

• ActivityPointer
• Annotation
• BulkOperation
• Calendar
• CalendarRule
• CustomerOpportunityRole
• Discount
• DiscountType
• IncidentResolution
• KbArticle
• KbArticleComment
• KbArticleTemplate
• Notification
• OpportunityClose
• OrderClose
• ProductPriceLevel
• QuoteClose
• RecurrenceRule
• Resource
• ResourceGroup
• ResourceGroupExpansion
• ResourceSpec
• SalesLiteratureItem
• SalesProcessInstance
• Service
• Subject
• Template
• UoM
• UoMSchedule
• Workflow
• WorkflowLog

Configure auditing for an environment

There are three levels where auditing can be configured: an environment, table, and column. Auditing must be turned on at the environment-level first. To log data changes in a table, auditing must be turned on for the table, and for the column.

To turn on user access auditing (log access) or activity logging (Read logs), auditing must be turned on at the environment-level. The option to turn on activity logging is only visible when the minimum Office licensing requirements are met.

You must have System Administrator or System Customizer role or equivalent permissions to turn on or off auditing.

Auditing can be configured manually through the Power Platform admin center and the Power Apps portal. Auditing can also be configured programmatically. Learn more at Auditing overview.

Turn on auditing through Security page (Preview)

[This section is prerelease documentation and is subject to change.]

You must be assigned to the Power Platform or Dynamics 365 admin role to turn on or off auditing through the Security page.

To meet your external and internal auditing, compliance, security, and governance policies that are common to many enterprises, auditing for the following tables are turned on automatically when you turn on auditing through the Security page. You can audit other tables, where applicable, but please note that there are some core tables that audit is turned on by default.

1. Go to the Power Platform admin center.
2. From the left-side menu, select Security.
3. Select the Auditing tile.
4. Select the environment that you want to turn on auditing.
5. Select the Turn on auditing switch.
6. Review the list of Dataverse data and Dynamics 365 apps entities.
7. Review and update the Event log retention by selecting the dropdown.
8. Select the period that meets your data retention policy.
9. The selected period is effective from the current date and overrides the existing retention policy. To apply the new retention policy for new logs only, select to switch the Existing logs to On.

Start/stop auditing for an environment and set retention policy

This task requires the System Administrator or System Customizer role or equivalent permissions.

1. Sign in to the Power Platform admin center using administrator credentials.

2. Go to Environments > [select an environment] > Settings > expand Audit and logs > Audit settings.

   Setting	Description
   Start Auditing	Start or stop auditing.
   Log access	Log whenever the system is accessed, generally by signing in.
   Read logs	Logs will be sent to the Microsoft Purview compliance portal.

3. You can set a retention period for how long audit logs are kept in an environment. Under Retain these logs for, choose the period of time you wish to retain the logs.

   Setting	Description
   Set the retention policy for these logs	Default: Forever
   Set a custom retention policy	Maximum: 24,855 days. Visible if you select "Custom" in the above setting.

5. Select Save.

Learn more in the Configure organization settings.

Turn on auditing for a specific app in a web app

This task requires the System Administrator or System Customizer role or equivalent permissions.

This feature allows you to quickly turn on auditing for multiple tables (entities) simultaneously. The grouping of tables corresponds to a Dynamics 365 application, for example Sales tables correspond to the Sales Hub app.

1. In the web app, go to Settings () > Advanced Settings.

2. Select Settings > Administration.

3. Select System Settings, and then select the Auditing tab.

4. Select the table (entities) you want to track. To start or stop auditing on specific tables, select or clear the following check boxes:

   • Common Entities. Tracks common entities like Account, Contact, Goal, Product, and User.
   • Sales Entities. Tracks sales-related entities like Competitor, Opportunity, Invoice, Order, and Quote.
   • Marketing Entities. Tracks Campaign entity activity.
   • Customer Service Entities. Tracks Case, Contract, Queue, and Service entity activity.

5. Select OK.

Configure auditing for one or more tables and columns in Power Apps

This task requires the System Administrator or System Customizer role or equivalent permissions.

1. Sign in to Power Apps using your System Administrator or System Customizer credentials.

2. Select the environment for which you want to configure auditing.

   Note

   We recommend that you manage the audit configuration as part of a solution. This allows you to easily find your customizations, apply your own solution published prefix, and export your solution for distribution to other environments. To learn more about solutions, see Use a solution to customize. When using a solution, add all tables you want to configure for auditing to your solution, then perform steps 3-8 before saving and publishing your solution.

3. Select Dataverse > Tables.

4. Select a table.

   

5. On the command bar, select Edit.

6. On the command bar, select Edit table properties.

7. Expand Advanced options.

8. Select the Audit changes to its data checkbox.

   

9. Select Save.

10. On the command bar, select <- Back.

11. Under Schema, select Columns.

    

12. Select a column you want to turn on for auditing, and then expand Advanced options.

    

13. Select the Enable auditing checkbox.

    

14. Select Save.

15. Repeat steps 3 – 10 for all tables and columns you want to edit.

Turn on or off auditing for entities and fields

System administrators or customizers can change the default audit settings for entities and for specific fields for an entity.

Turn on or off auditing for an entity

1. Browse to the Power Platform admin center and sign in using administrator credentials.

2. Go to Environments > [select an environment] > Settings > expand Audit and logs > Entity and Field Audit Settings.

3. Under Components, expand Entities.

4. Select the entity for which you want to turn on auditing.

5. To start auditing, on the General tab, in the Data Services section, select the Auditing check box to turn on auditing, or clear the Auditing check box to turn it off.

   By default, when you start or stop auditing for an entity, you also start or stop auditing for all the fields of this entity.

   If you have turned on the Read Logs in the environment's audit settings, you'll need to turn on the Single record auditing. Log a record when opened and Multiple record auditing. Log all records displayed on an opened page auditing settings to see the read audit logs from this table. Learn more at Activity logging.

6. Select Save.

7. Publish the customization. To publish for a single entity, choose the entity, such as Account, and then select Publish on the toolbar.

Turn on or off auditing for specific fields on an entity

1. Under the entity for which you want to turn on auditing with specific fields, select Fields.

2. To turn on or off auditing for a single field, open the field and in the Auditing section, select Enable or Disable.

   To turn on or off auditing for more than one field, select the fields you want, and then on the toolbar select Edit. In the Edit Multiple Fields dialog box, in the Auditing area, select Enabled or Disabled.

3. Select Save.

4. Publish the customization. To publish for a single entity, choose the entity, such as Account, and then select Publish on the Actions toolbar.

More information: Dataverse developer guide: Configure auditing > Configure tables and columns

Use the Audit History in a model-driven app

Audit History is a valuable resource for users to understand the update history of a single record. It answers questions such as "When was this record created and by whom?", "Who changed a particular field and what was the previous value?", "Who shared the record with another user?".

Users must have the View Audit History privilege to see the Audit History of a record.

1. Select a record in a model-driven application.

2. Select the Related tab and select Audit History.

   

3. Choose a field in Filter on to filter results by a field you want to see the change history.

   

Use the Audit Summary view

The Audit Summary view is a comprehensive list of all audit logs in an environment. By filtering on various columns, users of the Audit Summary view can understand what happened in the environment over time. It helps to answer questions such as "What actions did a user perform and when", "Who deleted a particular record?", or "Who changed a user's role?".

Users must have the View Audit Summary privilege to see the Audit Summary view.

1. Sign in to the Power Platform admin center, and then select an environment.

2. In the Auditing card, select Delete Logs.

3. Select View Audit Logs.

   

4. Use the Enable/Disable Filters option to narrow down the list of audit records needed to answer your question. You can apply several filters at once.

   

   Note

   Sorting is only possible on the Changed Date column.

   Exporting of Audit logs is currently not supported. Use the Web API or SDK for .NET to retrieve audit data from your environment. See Retrieve and delete the history of audited data changes.

   Large attribute values, such as Email.description or Annotation, are limited (capped) at 5KB or ~5,000 characters. A capped attribute value can be recognized by three dots at the end of the text, for example, "lorem ipsum, lorem ip…".

More information: Dataverse developer guide: Retrieve the history of audited data changes

Delete the change history for a record

Dataverse auditing supports the deletion of a single record's entire audit history. This is useful when responding to a customer's request to delete their data.

Users must have the Delete Audit Record Change History privilege to perform this action.

The deletion of a record's audit history can be done in a model-driven application's Audit History and in the environment's Audit Summary view.

Delete the change history for a record in the Audit History tab of a record

1. Select a record in a model-driven application.

2. Select the Related tab, and then select Audit History.

   

3. In Filter on, choose All fields, and then select Delete Change History to delete all logs pertaining to the selected record.

   

4. Select Delete to confirm.

Delete the change history for a record in the Audit Summary view

1. Sign in to the Power Platform admin center, and then select an environment.

2. In the Auditing card, select Delete logs.

3. Select View Audit Logs.

   

4. Select a row in the audit history, and then select Delete Change History to delete all logs pertaining to the selected record.

   

5. Select Delete to confirm.

Reduce log storage: Delete audit logs – legacy process

When you turn on Dataverse auditing, your apps create audit logs to store changes to the records and user access. You can delete audit logs when they are no longer needed to free up log capacity space.

1. In the upper-right corner of an app, select Settings () > Advanced Settings > Settings > Auditing.

2. Select Audit Log Management, and then select View Audit Logs.

3. Select the oldest audit log, then select Delete Logs.

4. Select OK to confirm.

Reduce log storage: Delete audit logs – new process

When you turn on Dataverse auditing, your apps create audit logs to store changes to the records and user access. You can delete audit logs when they are no longer needed to free up log capacity space.

1. Sign in to the Power Platform admin center, and then select an environment.

2. Under Auditing, select Delete logs.

3. Choose how to select logs to delete.

   Delete logs	Description	System job name
   Logs by table	Select one or more tables for which you want to delete audit logs. By default, all tables in the environment will be shown, whether they contain audit data or not.	Delete logs for [number of] tables.
   Access logs by people and systems	Delete all access logs. This will delete all logs for all users and systems.	Delete access logs.
   All logs up to and including the selected date	Delete logs including the date selected.	Delete all logs before and including [timestamp].

   

4. Select Delete, and then confirm.

   Note

   Audit logs will be deleted in an asynchronous background system job. The duration of the deletion depends on the amount of audit records to be deleted. The current rate is approximately 100 million records per day, or approximately 4 million records per hour.

   To monitor the status of audit delete jobs, see the next section.

Monitoring system jobs

Several features use system jobs to perform tasks automatically, including workflows, import, and duplicate detection, running independently or in the background. You can monitor them to ensure that they run smoothly or have completed successfully.

1. In the Power Platform admin center, select an environment.

   For Unified Interface, in the upper-right corner, select Settings () > Advanced Settings > Settings.

2. Select Settings > Audit and logs > System Jobs to see a grid view of system jobs.

If there is a problem with a system job, you can cancel, postpone, pause, or resume it. Select a job and then select the Actions menu.

• Canceling system jobs

  You cannot resume a canceled system job.

• Postponing completion of system jobs

  Postponing an active system job stops any current and subsequent actions. You can specify a later time when you want the system job to restart.

• Pausing system jobs

  You can resume a paused system job.

• Resuming paused system jobs

  Resuming restarts a system job that was paused.

  Tip

  1. If a system job fails, you can view the details about what steps failed and what the problems may have been. First, open the system job record. To display details about system job failures, move your pointer over the warning symbols.
  2. To view system job failures in a format that you can print or copy and paste, select the Print button.

Monitor the status of audit delete jobs

1. In the Power Platform admin center, select an environment.

   For Unified Interface, in the upper-right corner, select Settings () > Advanced Settings > Settings.

2. Select Settings > Data management > Bulk deletion.

Select the system job name to open details about your delete job.

Access audit data using Azure Synapse Link for Dataverse

You can use Azure Synapse link for Dataverse to link the audit table and create reports using Power BI to meet your external and internal auditing, compliance, and governance needs. More information: Access audit data using Azure Synapse Link for Dataverse and Power BI

See also

Auditing overview
Audit user access