Could the team reconstruct the activity needed for an investigation or assurance request?
Establish which questions your current audit evidence can answer, for which users and over what period.
Begin with the business decision and the affected population. A targeted workload review may be sufficient; an interconnected tenant assessment may be more useful where the same identity, device or data dependency affects several services.
Evidence we agree to examine
- Audit capability, enabled workloads, role access and representative events
- Actual user licensing, record types, configured retention and available time range
- Export or SIEM integration, collection failures, review ownership and escalation
- Evidence handling, access restrictions, query reproducibility and time-zone conventions
Why context changes the conclusion
A retention policy on paper does not prove that the requested historic event is available. Validate representative records and make any date or workload gaps explicit.
Treat this as an assessment question, not a finding about your organisation. During an engagement, a conclusion must identify the dated evidence, the sampled population and any exceptions that could not be corroborated.
The output your team can use
An event coverage and retention matrix, with investigation limitations and a logging improvement plan.
Each action should identify its accountable owner, licence or business dependency, proposed rollout safeguards and the record that will demonstrate successful closure. A policy screenshot alone is not enough when the finding concerns coverage or sustained operation.
Access and boundaries
Purview audit records and Entra sign-in logs are different datasets with different retention rules. Historical gaps cannot be recovered simply by increasing retention later.
We agree evidence access before work begins. Your team can lead supervised sessions and provide approved, minimised exports. The assessment does not require you to send passwords, grant access through this website or permit production changes. See access and data handling.
Prepare your audit request
Use the Microsoft 365 Audit Planner for a licence-aware starting scope, or the detailed scoping assistant. Review the brief and send it with your enquiry. You can attach your NDA or RFP in the contact form.
Sources & further reading
Reviewed 6 October 2026. Product names, licence entitlements and guidance can change. Confirm applicability to your tenant and agreed assessment date.
