---
id: video/lk1YJKOmHyI
type: video
title: "What's New: Auditing In Purview (2024 release wave 2)"
summary: "Auditing Business Central events in Microsoft Purview (2024 release wave 2): the Purview portal shows user operations across Microsoft services, including Business Central, with event search, 180-day default retention (extendable to 10 years with licenses), and PowerShell or API access."
tier: official
language: en
tags:
  - auditing
  - purview
  - compliance
  - forensic investigations
  - event search
  - data retention
  - powershell
  - management activity api
system: administration
review:
  state: reviewed
  by: opus
  at: "2026-10-07T23:04:00.534Z"
  flags: []
generated:
  at: "2026-10-07T23:04:00.567Z"
  pipeline: 0.2.0
  prompts:
    extract-video: 1
    summarize-video: 2
  input_hash: b6e32cd7549ec49b528bf634707be2792b3905c31961463472b7eb5f6a7d6065
evidence:
  - kind: video
    url: https://www.youtube.com/watch?v=lk1YJKOmHyI&t=6s
    title: "What's New: Auditing In Purview (2024 release wave 2)"
    date: "2024-10-08T15:00:54.000Z"
    commit: null
    t: 6
    quote: pview is an auditing solution that allows audit administrators to see operations executed by users across all Microsoft services including business Central in a
  - kind: video
    url: https://www.youtube.com/watch?v=lk1YJKOmHyI&t=26s
    title: "What's New: Auditing In Purview (2024 release wave 2)"
    date: "2024-10-08T15:00:54.000Z"
    commit: null
    t: 26
    quote: this can help responding to security events in case you want to see what a user did for example after an account is compromised
  - kind: video
    url: https://www.youtube.com/watch?v=lk1YJKOmHyI&t=26s
    title: "What's New: Auditing In Purview (2024 release wave 2)"
    date: "2024-10-08T15:00:54.000Z"
    commit: null
    t: 26
    quote: you can use it to run forensic investigations and for customers with specific business needs or um industry compliance requirements
  - kind: video
    url: https://www.youtube.com/watch?v=lk1YJKOmHyI&t=148s
    title: "What's New: Auditing In Purview (2024 release wave 2)"
    date: "2024-10-08T15:00:54.000Z"
    commit: null
    t: 148
    quote: auditing is included and enabled by default with most Microsoft 365 plans meaning that if you have one of the included Microsoft 365 plans
  - kind: video
    url: https://www.youtube.com/watch?v=lk1YJKOmHyI&t=168s
    title: "What's New: Auditing In Purview (2024 release wave 2)"
    date: "2024-10-08T15:00:54.000Z"
    commit: null
    t: 168
    quote: pview retains the locks for 180 days but by purchasing add-on licenses or with specific Microsoft 365 plans you can extend this up to
  - kind: video
    url: https://www.youtube.com/watch?v=lk1YJKOmHyI&t=168s
    title: "What's New: Auditing In Purview (2024 release wave 2)"
    date: "2024-10-08T15:00:54.000Z"
    commit: null
    t: 168
    quote: the easiest way to get to pview events is in the pview portal where you can run manual reports
links:
  learn: []
  objects: []
  features: []
  topics: []
  localizations: []
  videos: []
  posts: []
  guidelines: []
video_id: lk1YJKOmHyI
channel: yt-microsoft
source_name: Microsoft Dynamics 365 Business Central (YouTube)
url: https://www.youtube.com/watch?v=lk1YJKOmHyI
published_at: "2024-10-08T15:00:54.000Z"
duration_s: 213
captions: full
audience:
  - administrator
  - functional consultant
  - decision maker
chapters:
  - t: 0
    title: Introduction to auditing in Purview
  - t: 46
    title: Purview portal demo and event search
  - t: 128
    title: Event categories and default enablement
  - t: 168
    title: Data retention and advanced access methods
features:
  - name: Auditing Business Central events in Purview
    status: unclear
    t: 6
    verified: false
    status_source: video
  - name: Purview portal event filtering and search
    status: unclear
    t: 46
    verified: false
    status_source: video
  - name: Environment Administration event auditing
    status: unclear
    t: 128
    verified: false
    status_source: video
  - name: Report Administration event auditing
    status: unclear
    t: 128
    verified: false
    status_source: video
  - name: Default Purview enablement with Microsoft 365
    status: unclear
    t: 148
    verified: false
    status_source: video
  - name: Purview data retention with extension options
    status: unclear
    t: 168
    verified: false
    status_source: video
  - name: PowerShell and Management Activity API access
    status: unclear
    t: 188
    verified: false
    status_source: video
objects_mentioned: []
quotes:
  - t: 6
    text: pview is an auditing solution that allows audit administrators to see operations executed by users across all Microsoft services including business Central in a
    check: exact
  - t: 26
    text: this can help responding to security events in case you want to see what a user did for example after an account is compromised
    check: exact
  - t: 26
    text: you can use it to run forensic investigations and for customers with specific business needs or um industry compliance requirements
    check: exact
  - t: 148
    text: auditing is included and enabled by default with most Microsoft 365 plans meaning that if you have one of the included Microsoft 365 plans
    check: exact
  - t: 168
    text: pview retains the locks for 180 days but by purchasing add-on licenses or with specific Microsoft 365 plans you can extend this up to
    check: exact
  - t: 168
    text: the easiest way to get to pview events is in the pview portal where you can run manual reports
    check: fuzzy
---

# What's New: Auditing In Purview (2024 release wave 2)

> Auditing Business Central events in Microsoft Purview (2024 release wave 2): the Purview portal shows user operations across Microsoft services, including Business Central, with event search, 180-day default retention (extendable to 10 years with licenses), and PowerShell or API access.

[Watch on YouTube](https://www.youtube.com/watch?v=lk1YJKOmHyI) · Microsoft Dynamics 365 Business Central (YouTube) · 2024-10-08 · 3:33 · tier official · reviewed (checked by Opus)

## Overview

The video introduces auditing of Business Central events in Purview. Audit administrators can see operations run by users across all Microsoft services, including Business Central, in a single portal. This supports responding to security events, such as checking what a user did after an account was compromised, and forensic investigations.

The demo covers the Purview portal, where events can be filtered and searched by record type, activity category, keyword, user and date range. It describes the Environment Administration and Report Administration event categories, default enablement with most Microsoft 365 plans, and data retention. It also mentions PowerShell and the management activity API for access beyond the portal. The presenters say this is only the beginning and ask for ideas on what else to add.

## Key points

- Purview lets audit administrators see user operations across Microsoft services, including Business Central, in one portal.
- Use cases include responding to security events such as compromised accounts, forensic investigations and meeting industry compliance requirements.
- Portal event search can filter by record type, activity category, keyword, user and date range.
- Environment Administration events cover everything done in the Business Central admin center for environments.
- Report Administration events cover changes made to reporting in a Business Central environment.
- Auditing is included and enabled by default with most Microsoft 365 plans; with an included plan nothing needs to be done to enable it.
- Purview keeps audit logs 180 days by default; up to 10 years needs add-on licenses or specific Microsoft 365 plans.

## Chapters

- [0:00](https://www.youtube.com/watch?v=lk1YJKOmHyI&t=0s) Introduction to auditing in Purview
- [0:46](https://www.youtube.com/watch?v=lk1YJKOmHyI&t=46s) Purview portal demo and event search
- [2:08](https://www.youtube.com/watch?v=lk1YJKOmHyI&t=128s) Event categories and default enablement
- [2:48](https://www.youtube.com/watch?v=lk1YJKOmHyI&t=168s) Data retention and advanced access methods

## Features

| Feature | Status | At |
|---|---|---|
| Auditing Business Central events in Purview | status not stated, demoed | [0:06](https://www.youtube.com/watch?v=lk1YJKOmHyI&t=6s) |
| Purview portal event filtering and search | status not stated, demoed | [0:46](https://www.youtube.com/watch?v=lk1YJKOmHyI&t=46s) |
| Environment Administration event auditing | status not stated | [2:08](https://www.youtube.com/watch?v=lk1YJKOmHyI&t=128s) |
| Report Administration event auditing | status not stated | [2:08](https://www.youtube.com/watch?v=lk1YJKOmHyI&t=128s) |
| Default Purview enablement with Microsoft 365 | status not stated | [2:28](https://www.youtube.com/watch?v=lk1YJKOmHyI&t=148s) |
| Purview data retention with extension options | status not stated | [2:48](https://www.youtube.com/watch?v=lk1YJKOmHyI&t=168s) |
| PowerShell and Management Activity API access | status not stated | [3:08](https://www.youtube.com/watch?v=lk1YJKOmHyI&t=188s) |

## Quotes

- [0:06](https://www.youtube.com/watch?v=lk1YJKOmHyI&t=6s) "pview is an auditing solution that allows audit administrators to see operations executed by users across all Microsoft services including business Central in a"
- [0:26](https://www.youtube.com/watch?v=lk1YJKOmHyI&t=26s) "this can help responding to security events in case you want to see what a user did for example after an account is compromised"
- [0:26](https://www.youtube.com/watch?v=lk1YJKOmHyI&t=26s) "you can use it to run forensic investigations and for customers with specific business needs or um industry compliance requirements"
- [2:28](https://www.youtube.com/watch?v=lk1YJKOmHyI&t=148s) "auditing is included and enabled by default with most Microsoft 365 plans meaning that if you have one of the included Microsoft 365 plans"
- [2:48](https://www.youtube.com/watch?v=lk1YJKOmHyI&t=168s) "pview retains the locks for 180 days but by purchasing add-on licenses or with specific Microsoft 365 plans you can extend this up to"
- [2:48](https://www.youtube.com/watch?v=lk1YJKOmHyI&t=168s) "the easiest way to get to pview events is in the pview portal where you can run manual reports"

## Disclaimers in the video

- [3:08](https://www.youtube.com/watch?v=lk1YJKOmHyI&t=188s) coming-later: this is only the beginning of auditing business Central events in prview and we'd really like to hear your ideas on what else you would want to see