When Auditing meets Telemetry: a practical example.
A real case where Default Dimension records disappeared. Change Log showed the user and the time, but telemetry traces and page views showed that the user had unknowingly triggered the deletion by running a calculation action. A temporary-record check placed too late in the code caused real dimension data to be deleted. The fix was to move that check to the first line of the OnAfterDeleteEvent.
post Dynamics 365 Business Central tales, myths, legends. And something serious.
"Telemetry can do A LOT of good things but unfortunately it was not meant to be used for pure AUDITING purposes."
Key points
- Change Log records what changed (user, date, deletion event) but not always why or the context of the action
- Telemetry traces provide execution context showing which code triggered the deletion and when
- The combination of both auditing tools solved a mystery where the user was innocent but the Change Log was factually correct
- A late placement of a temporary record check caused real data deletion instead of temporary record deletion
- Moving the temporary record validation to the start of the OnAfterDeleteEvent prevented accidental dimension deletion
Quotes
- “Telemetry can do A LOT of good things but unfortunately it was not meant to be used for pure AUDITING purposes.” (Clarifies the intended scope of telemetry and sets expectations for when to use Change Log instead)
- “With a simple query that scanned both traces and page views, we were able to determine the innocence of the user” (Shows how telemetry provides execution context that audit logs alone cannot, solving investigations faster)
- “just one line, and where you place it, makes a big difference” (Demonstrates how code placement of validation logic directly impacts whether temporary or real data gets deleted)
AL objects mentioned
As named in the post. A name that matches one object page by exact type and name links to it; the others stay as named.
Context
- Features: Change Log, Microsoft Purview, Telemetry, OnAfterDeleteEvent, Security Auditing, Data Auditing
- Versions: 2024 Wave 2
Source: Duilio Tacconi, community blog. Summary, key points and quotes are derived (CONTENT-NOTICE.md); read the original for the full text.