Before you begin
- A role that can view the audit trail: Admin, Security Admin, Auditor, Billing Viewer, Reports Viewer, or Read Only
- To export: Admin, Security Admin, or Auditor
Where to find it
Open Audit in the sidebar's Security section. The page brings user activity (sign-ins, role changes, exports) and infrastructure changes (VM, host pool, and Azure resource actions) into one chronological list, and a Live badge shows when new entries are arriving in real time.
What's in an audit entry
Each entry records when it happened, its source (user activity or infrastructure), who did it, the action, its severity (infrastructure entries), the resource, and details. Details include before-and-after values where they apply, the raw metadata, and a correlation ID you can copy to trace one operation across entries. If a user's personal data was erased on request, their entries remain but show "(User data removed)".
Searching and filtering
- Search by user, email, action, resource, or correlation ID.
- Narrow by source, action, severity, resource type, and user email.
- Pick a date range with the Last 24 hours, Last 7 days, and Last 30 days presets, or set From and To dates for a custom range.
- From any row's actions menu, filter to that user, action, or resource type in one click.
- The headline figures (Total audit events, Unique users, Action types, Resources) always describe the entries in view.
Exporting for compliance
Use Export in the page header to download the entries in view as PDF, Excel, or CSV; select rows first to export only those. PDF exports are capped at 5,000 rows, so use CSV or Excel for larger sets. Every export is itself recorded in the trail as Audit Exported.
Audit entries are always scoped to your tenant. There is intentionally no way to view another tenant's audit trail.
CMMC alignment
The audit trail is designed around the CMMC audit and accountability controls: it records security-relevant events, captures who, what, when, where, and the outcome for each, supports review by filtering and reporting, protects the record (exports are themselves audited), and uses one shared list of action names so every part of Atlas records events the same way.
Related security events
Role changes, user additions and removals, and every denied permission check (RBAC Denied) appear in the trail, and repeated denials from one user raise a critical alert. Atlas Reach activity, such as remote sessions, script runs, and device enrollments, is recorded here too. To keep an eye on the trail from your dashboard, add the Audit Summary widget.