--- id: post/duiliotacconi-com/1601 type: post title: "When Auditing meets Telemetry: a practical example." summary: A real case where Default Dimension records disappeared. Change Log showed the user and the time, but telemetry traces and page views showed that the user had unknowingly triggered the deletion by running a calculation action. A temporary-record check placed too late in the code caused real dimension data to be deleted. The fix was to move that check to the first line of the OnAfterDeleteEvent. tier: community language: en tags: - auditing - change log - telemetry - troubleshooting - data security system: administration review: state: reviewed by: opus at: "2026-10-08T01:59:23.060Z" flags: [] generated: at: "2026-10-08T01:26:53.141Z" pipeline: 0.2.0 prompts: extract-post: 1 input_hash: a43c95c2a7e03958049d48858efa5b6f11e8a50b23cd480af07b7202d36e940f evidence: - kind: blog url: https://duiliotacconi.com/2025/09/05/when-auditing-meets-telemetry-a-practical-example/ title: "When Auditing meets Telemetry: a practical example." date: "2025-09-05" commit: null t: null quote: null - kind: blog url: https://duiliotacconi.com/2025/09/05/when-auditing-meets-telemetry-a-practical-example/ title: "When Auditing meets Telemetry: a practical example." date: "2025-09-05" commit: null t: null quote: Telemetry can do A LOT of good things but unfortunately it was not meant to be used for pure AUDITING purposes. - kind: blog url: https://duiliotacconi.com/2025/09/05/when-auditing-meets-telemetry-a-practical-example/ title: "When Auditing meets Telemetry: a practical example." date: "2025-09-05" commit: null t: null quote: With a simple query that scanned both traces and page views, we were able to determine the innocence of the user - kind: blog url: https://duiliotacconi.com/2025/09/05/when-auditing-meets-telemetry-a-practical-example/ title: "When Auditing meets Telemetry: a practical example." date: "2025-09-05" commit: null t: null quote: just one line, and where you place it, makes a big difference links: learn: [] objects: - object/table/352 features: [] topics: [] localizations: [] videos: [] posts: [] guidelines: [] post_id: "1601" source_id: duiliotacconi-com source_name: Duilio Tacconi url: https://duiliotacconi.com/2025/09/05/when-auditing-meets-telemetry-a-practical-example/ published_at: "2025-09-05T11:55:09.000Z" author: Duilio Tacconi full_text: false words: 699 quotes: - text: Telemetry can do A LOT of good things but unfortunately it was not meant to be used for pure AUDITING purposes. why_it_matters: Clarifies the intended scope of telemetry and sets expectations for when to use Change Log instead - text: With a simple query that scanned both traces and page views, we were able to determine the innocence of the user why_it_matters: Shows how telemetry provides execution context that audit logs alone cannot, solving investigations faster - text: just one line, and where you place it, makes a big difference why_it_matters: Demonstrates how code placement of validation logic directly impacts whether temporary or real data gets deleted code_objects_mentioned: - table Default Dimension systems: - administration - development versions_mentioned: - 2024 Wave 2 preview: embeddable: true frame_url: https://duiliotacconi.com/2025/09/05/when-auditing-meets-telemetry-a-practical-example/embed/ image: https://i0.wp.com/duiliotacconi.com/wp-content/uploads/2025/09/screenshot-2025-09-05-134707.png?fit=1200%2C479&ssl=1 image_alt: null image_w: 1200 image_h: 479 site_name: Dynamics 365 Business Central tales, myths, legends. And something serious. favicon: https://duiliotacconi.com/wp-content/uploads/2023/07/cropped-wordpress.png?w=32 probed_at: "2026-10-07T11:50:59.832Z" --- # When Auditing meets Telemetry: a practical example. [Read the post](https://duiliotacconi.com/2025/09/05/when-auditing-meets-telemetry-a-practical-example/) · Duilio Tacconi (Duilio Tacconi, MVP) · 2025-09-05 · 699 words · tier community · reviewed (checked by Opus) > A real case where Default Dimension records disappeared. Change Log showed the user and the time, but telemetry traces and page views showed that the user had unknowingly triggered the deletion by running a calculation action. A temporary-record check placed too late in the code caused real dimension data to be deleted. The fix was to move that check to the first line of the OnAfterDeleteEvent. ## Key points - Change Log records what changed (user, date, deletion event) but not always why or the context of the action - Telemetry traces provide execution context showing which code triggered the deletion and when - The combination of both auditing tools solved a mystery where the user was innocent but the Change Log was factually correct - A late placement of a temporary record check caused real data deletion instead of temporary record deletion - Moving the temporary record validation to the start of the OnAfterDeleteEvent prevented accidental dimension deletion ## Quotes - "Telemetry can do A LOT of good things but unfortunately it was not meant to be used for pure AUDITING purposes." (Clarifies the intended scope of telemetry and sets expectations for when to use Change Log instead) - "With a simple query that scanned both traces and page views, we were able to determine the innocence of the user" (Shows how telemetry provides execution context that audit logs alone cannot, solving investigations faster) - "just one line, and where you place it, makes a big difference" (Demonstrates how code placement of validation logic directly impacts whether temporary or real data gets deleted) ## AL objects mentioned As named in the post. A name that matches one object page by exact type and name links to it; the others stay as named. - [table 352 "Default Dimension"](../../objects/table/352.md) ## Context - Features: Change Log, Microsoft Purview, Telemetry, OnAfterDeleteEvent, Security Auditing, Data Auditing - Versions: 2024 Wave 2 Source: Duilio Tacconi, community blog. Summary, key points and quotes are derived (CONTENT-NOTICE.md); read the original for the full text.