Does Atlas record every keystroke in the admin console?

No. In the Atlas console, Atlas records actions (every change, with before and after values), sign-ins and the pages each administrator opens. It doesn't record mouse movements or keystrokes there. In an Atlas Reach remote session, the whole session is recorded, and each action in it is audited.

Can an administrator delete or edit audit entries?

No. The audit tables reject updates and deletes at the database level, whoever is signed in. Only Atlas's own background processes can remove records, under a dedicated database role: the scheduled retention sweep, a data-erasure request, and removing a tenant entirely. A data-erasure request pseudonymises the person rather than removing their actions from the trail.

Which plans include the audit trail?

The Security → Audit page and its exports are included on every Atlas AVD plan. Session Replay is part of the Enterprise plan, and Atlas Reach is an add-on. See Atlas AVD pricing explained.

How long are audit records kept?

Infrastructure changes are kept for a year, and Entra ID sign-in logs and directory audits for a year. Atlas Reach recordings follow your Recording Retention setting, which defaults to 30 days.

Are changes made by automation recorded?

Yes. Scaling, scheduled actions, self-healing and other automatic changes are recorded under a named system actor, so you can always tell a person's change from Atlas's.

Can I give an external auditor access?

Yes. Assign the built-in Auditor (read-only + audit export) role. It can read and export audit records but can't change your environment. Or export the evidence as CSV, Excel or PDF and send the file.

Where is the audit data stored?

In your tenant's own database, inside your own Azure tenant. Atlas AVD runs inside your Azure tenant, so your audit trail stays there too.

Every Day, Every Action, Every Click: Inside the Atlas AVD Audit Trail

Who changed that host pool, who opened that remote session, and what exactly did they do? Atlas AVD records every administrator action, sign-in and page view, every change its automation makes, and every Atlas Reach remote session in one audit trail inside your Azure tenant. Here is what it captures, how you search and export it, why it can't be quietly edited, and how it maps to NIST SP 800-171 and CMMC.