Auditing overview
Microsoft Dataverse provides capabilities to meet the external and internal auditing, compliance, security, and governance policies that are common to many enterprises. Dataverse logs both user access and changes that are made to records. You can use the auditing tables and APIs to create client applications or programmatically interact with auditing data.
Note
Refer to Administrator's Guide: Manage Dataverse auditing for a complete description of auditing concepts and capabilities, how it's exposed in apps, and tasks for administrators. The tables and APIs described here support client applications used by administrators and can be used by developers for integration projects. This content doesn't describe all auditing concepts and capabilities.
You can use Dataverse tables and APIs to:
- Retrieve and change organization settings for auditing.
- Detect which tables and columns are enabled for auditing.
- Enable or disable tables and columns for auditing.
- Retrieve a history of audited data changes.
- Delete audit data.
Organization settings
Properties of the Organization table control how auditing is enabled for an environment. Retrieve column values to determine:
- Whether auditing is enabled for the environment
- The number of days to retain audit log records
- Whether user access logging is enabled
- How often user access is logged
If you have the System Administrator or System Customizer role, you can configure organization settings to change the auditing behavior.
More information: Configure organization settings
Table and column settings
When auditing is enabled for the organization, audit data is recorded in the tables that are enabled for auditing whenever data changes.
When auditing is enabled for a table, the columns that are enabled for auditing are included in the audit data.
Use Dataverse APIs to query table and column definitions to determine which tables and columns are enabled for auditing.
If you have the System Administrator or System Customizer role, you can configure tables and columns to change the auditing behavior.
More information: Configure tables and columns
Retrieve audit history
Audit history data is stored in the Auditing (Audit) table. Use the following messages to retrieve audit history data:
| Message | Description |
|---|---|
RetrieveAuditDetails |
Retrieve the full details of an audit record. |
RetrieveAttributeChangeHistory |
Retrieve the change history for a single column of an audited record. |
RetrieveRecordChangeHistory |
Retrieve the change history for all columns of an audited record. |
More information: Retrieve the history of audited data changes:
Delete audit data
You may need to delete audit data to comply with a customer's request to delete their history or to free up log capacity space. You can't directly delete records in the Auditing (Audit) table. Instead, Dataverse provides the following messages to delete audit history data:
| Message | Description |
|---|---|
DeleteRecordChangeHistory |
Deletes all the change history for a particular record. |
BulkDelete |
Asynchronously deletes records identified by a query. This message can be used to delete large numbers of audit records without blocking other activities. |
DeleteAuditData |
For customers using customer-managed encryption keys, this message deletes all audit data records up to a specified end date. |
More information: Delete audit data
See also
Manage Dataverse auditing
Configure auditing
Retrieve the history of audited data changes
Delete audit data