Microsoft Dataverse and model-driven apps activity logging

Protecting data, preserving privacy, and complying with privacy regulations are some of the highest priorities for your business. It's critical that you audit the entirety of data processing actions taking place to be able to analyze for possible security breaches. This information from Activity Logging can be used when you perform a Data Protection Impact Assessment (DPIA) addressing the use of Office, Power Apps, Power Automate, and customer engagement apps (Dynamics 365 Sales, Dynamics 365 Customer Service, Dynamics 365 Field Service, Dynamics 365 Marketing, and Dynamics 365 Project Service Automation).

This topic covers how you can set Power Apps, Power Automate, and customer engagement apps to audit a broad range of data processing activities and use the Microsoft Purview compliance portal to review the data in activity reports.

Requirements

• At least one user assigned a Microsoft/Office 365 E1 or greater license.
• Available for production and not sandbox environments.

What events are audited

Logging takes place at the SDK layer which means a single action can trigger multiple events that are logged. The following are a sample of user events you can audit. Admin events are currently not logged.

User and support-related events

Base schema

Schemas define which fields are sent to the Microsoft Purview compliance portal. Some fields are common to all applications that send audit data to Microsoft Purview, while others are specific to customer engagement apps. The Base schema contains the common fields.

Customer engagement apps schema

The customer engagement apps schema contains fields specific to customer engagement apps and partner teams.

Enable auditing

1. Choose Settings > Administration > System Settings > Auditing tab.

   • Or, from the Power Apps Home Page, select Settings (gear icon) > Advanced settings > Settings > Auditing > Global Audit Settings.

2. Under Audit Settings, enable the following check boxes:

   • Start Auditing
   • Audit user access (Note: captures user sign-in only)
   • Start Read Auditing (Note: captures most user activities/events)

3. Under Enable Auditing in the following areas, enable the check boxes for the areas you want to audit and then select OK.

   

4. To set table and field-level auditing, select Settings > Customizations > Customize the System.

   • Or, from the System Settings page (above), select Entity and Field Audit Settings.
   • Or, from the Power Apps Home Page, select Settings (gear icon) > Advanced settings > Settings > Customizations > Customize the System.

5. Under Components, expand Entities and select an entity to audit, such as Account.

6. Scroll down and under Data Services enable Auditing.

7. Under Auditing, enable the following check boxes:

   • Single record auditing. Log a record when opened.
   • Multiple record auditing. Log all records displayed on an opened page.

   

8. Choose Save.

9. Choose Publish to publish the customization.

10. Repeat steps 5 - 9 for other entities you want to audit.

11. Turn on audit logging in Microsoft Purview. See Turn audit log search on or off.

Review your audit data using reports in Microsoft Purview compliance portal

When audit log search is turned on in the Microsoft Purview compliance portal, user and admin activity from your organization is recorded in the audit log and retained for 90 days. However, your organization might not want to record and retain audit log data. Or you might be using a third-party security information and event management (SIEM) application to access your auditing data. In those cases, a global admin can turn off audit log search in Microsoft Purview. For more information, see Auditing solutions in Microsoft Purview.

To search for records in Microsoft Purview compliance portal, choose Record type as CRM, and Activities as All Dynamics 365 activities.

Create reports

You can create your own reports to review your audit data. See Search the audit log in the Purview compliance portal.

What's logged

For a list of what's logged with Activity Logging, see Microsoft.Crm.Sdk.Messages Namespace.

We log all SDK messages except the following:

• WhoAmI
• RetrieveFilteredForms
• TriggerServiceEndpointCheck
• QueryExpressionToFetchXml
• FetchXmlToQueryExpression
• FireNotificationEvent
• RetrieveMetadataChanges
• RetrieveEntityChanges
• RetrieveProvisionedLanguagePackVersion
• RetrieveInstalledLanguagePackVersion
• RetrieveProvisionedLanguages
• RetrieveAvailableLanguages
• RetrieveDeprovisionedLanguages
• RetrieveInstalledLanguagePacks
• GetAllTimeZonesWithDisplayName
• GetTimeZoneCodeByLocalizedName
• IsReportingDataConnectorInstalled
• LocalTimeFromUtcTime
• IsBackOfficeInstalled
• FormatAddress
• IsSupportUserRole
• IsComponentCustomizable
• ConfigureReportingDataConnector
• CheckClientCompatibility
• RetrieveAttribute

How we categorize read and readmultiple

We use the prefix to categorize.

Example generated logs

The following are some examples of logs created with Activity Logging.

Example 1 – Logs generated when user reads an Account record

Example 2 – Logs generated when user sees Account records in a Grid (Export to Microsoft Excel logs are like this)

Example 3 – List of messages logged when user converts a lead to opportunity

Additional considerations

When audit log search in the Microsoft Purview compliance portal is turned on, user and activity from your organization is recorded in the audit log and retained for 90 days. However, your organization might not want to record and retain audit log data. Or you might be using a third-party security information and event management (SIEM) application to access your auditing data. In those cases, a global admin can turn off audit log search in Microsoft 365.

Known issues

• Office has a 3KB limit for each audit record. Therefore, in some cases a single record from customer engagement apps needs to be split into multiple records in Office. The CorrelationId field can be used to retrieve the set of split records for a given source record. Operations that are likely to require splitting include RetrieveMultiple and ExportToExcel.
• Some operations need additional processing to retrieve all relevant data. For example, RetrieveMultiple and ExportToExcel are processed to extract the list of records that are retrieved or exported. However, not all relevant operations are yet processed. For example, ExportToWord is currently logged as single operation with no additional details about what was exported.
• In future releases, logging will disabled for operations that are determined to not be useful based on a review of the logs. For example, some operations result from automated system activity, not user activity.
• In some record instances, the EntityName value may be marked with Unknown. These records are not related to any specific entity related operation and came in blank from CRM. They all have entity id of 0000000-0000-0000-0000-000000000000.

See also

Manage Dataverse auditing
Search the audit log in the compliance Center
Search the audit log for user activity using Office 365 Management APIs overview