What's New: Auditing In Purview (2024 release wave 2)
Auditing Business Central events in Microsoft Purview (2024 release wave 2): the Purview portal shows user operations across Microsoft services, including Business Central, with event search, 180-day default retention (extendable to 10 years with licenses), and PowerShell or API access.
- Introduction to auditing in Purview
- Purview portal demo and event search
- Event categories and default enablement
- Data retention and advanced access methods
Overview
The video introduces auditing of Business Central events in Purview. Audit administrators can see operations run by users across all Microsoft services, including Business Central, in a single portal. This supports responding to security events, such as checking what a user did after an account was compromised, and forensic investigations.
The demo covers the Purview portal, where events can be filtered and searched by record type, activity category, keyword, user and date range. It describes the Environment Administration and Report Administration event categories, default enablement with most Microsoft 365 plans, and data retention. It also mentions PowerShell and the management activity API for access beyond the portal. The presenters say this is only the beginning and ask for ideas on what else to add.
Key points
- Purview lets audit administrators see user operations across Microsoft services, including Business Central, in one portal.
- Use cases include responding to security events such as compromised accounts, forensic investigations and meeting industry compliance requirements.
- Portal event search can filter by record type, activity category, keyword, user and date range.
- Environment Administration events cover everything done in the Business Central admin center for environments.
- Report Administration events cover changes made to reporting in a Business Central environment.
- Auditing is included and enabled by default with most Microsoft 365 plans; with an included plan nothing needs to be done to enable it.
- Purview keeps audit logs 180 days by default; up to 10 years needs add-on licenses or specific Microsoft 365 plans.
Features
| Feature | Status | At |
|---|---|---|
| Auditing Business Central events in Purview | status not stated, demoed | 0:06 |
| Purview portal event filtering and search | status not stated, demoed | 0:46 |
| Environment Administration event auditing | status not stated | 2:08 |
| Report Administration event auditing | status not stated | 2:08 |
| Default Purview enablement with Microsoft 365 | status not stated | 2:28 |
| Purview data retention with extension options | status not stated | 2:48 |
| PowerShell and Management Activity API access | status not stated | 3:08 |
Quotes
- 0:06 “pview is an auditing solution that allows audit administrators to see operations executed by users across all Microsoft services including business Central in a”
- 0:26 “this can help responding to security events in case you want to see what a user did for example after an account is compromised”
- 0:26 “you can use it to run forensic investigations and for customers with specific business needs or um industry compliance requirements”
- 2:28 “auditing is included and enabled by default with most Microsoft 365 plans meaning that if you have one of the included Microsoft 365 plans”
- 2:48 “pview retains the locks for 180 days but by purchasing add-on licenses or with specific Microsoft 365 plans you can extend this up to”
- 2:48 “the easiest way to get to pview events is in the pview portal where you can run manual reports”
Disclaimers in the video
- 3:08 coming-later: this is only the beginning of auditing business Central events in prview and we’d really like to hear your ideas on what else you would want to see