Microsoft Dataverse and model-driven apps activity logging

Activity Logging data supports Data Protection Impact Assessment (DPIA) for Power Apps, Power Automate, and customer engagement apps such as Dynamics 365 Sales, Dynamics 365 Customer Service, Dynamics 365 Field Service, Dynamics 365 Marketing, and Dynamics 365 Project Service Automation.

This topic explains how to configure Power Apps, Power Automate, and customer engagement apps to audit a broad range of data processing activities. You can then view the logged data in activity reports using the Microsoft Purview portal.

Requirements

• At least one user assigned a Microsoft Office 365 E1 or greater license.
• Available for production and not sandbox environments.

What events are audited

Logging takes place at the SDK layer which means a single action can trigger multiple events that are logged. The following are a sample of user events you can audit. Admin events are currently not logged.

User and support-related events

Base schema

Schemas define which fields are sent to the Microsoft Purview portal. Some fields are common to all applications that send audit data to Microsoft Purview, while others are specific to customer engagement apps. The Base schema contains the common fields.

Customer engagement apps schema

The customer engagement apps schema contains fields specific to customer engagement apps and partner teams.

Enable auditing

Access requires sufficient permissions, such as System Administrator or System Customizer role. To check your security role, see View your user profile. If you don't have the correct permissions, contact your system administrator.

Configure audit settings On the Audit settings page:

1. Under Auditing, enable the following options:
   • Start Auditing - Activates auditing for the environment.
   • Log access - Tracks user sign-ins.
   • Read logs - captures most user activities and events.
2. Set the retention policy for auditing logs based on your requirements.
3. Select Save to apply the changes.

Set organization-level auditing on tables

1. On the Audit settings page, select Global Audit Settings.
2. Under Enable Auditing in the following areas, select the check boxes for the areas you want to audit.
3. Select OK to apply the changes.

Set table-level auditing

1. Sign in to Power Apps Home Page. Be sure to turn on the modern experience.
2. In the command bar, select Settings, then choose Advanced settings to go to Microsoft Dynamics 365.
3. In settings, select Customizations, then select Customize the System.
4. In the navigation pane, under Components, expand Entities and select the entity to audit (for example, Account).
5. Scroll down to Data Services, then enable the check box for Auditing.
6. Under Auditing, enable the following options:
   • Single record auditing. Log a record when opened.
   • Multiple record auditing. Log all records displayed on an opened page.
7. In the command bar, select Save to apply the changes.
8. Select Publish to finalize the customization.
9. Repeat steps 4-8 for other tables you want to audit.
10. Turn on audit logging in Microsoft Purview. See Turn audit log search on or off.

Review your audit data using reports in Microsoft Purview portal

When audit log search is turned on in the Microsoft Purview portal, user and admin activity from your organization is recorded in the audit log and retained for 90 days. However, your organization might not want to record and retain audit log data. Or you might be using a third-party security information and event management (SIEM) application to access your auditing data. In those cases, a global admin can turn off audit log search in Microsoft Purview. For more information, see Auditing solutions in Microsoft Purview.

To search for records in Microsoft Purview portal, choose Record type as CRM, and Activities as All Dynamics 365 activities.

Create reports

You can create your own reports to review your audit data. See Search the audit log in the Microsoft Purview portal.

See what's logged

For a list of what's logged with Activity Logging, see Microsoft.Crm.Sdk.Messages Namespace.

We log all SDK messages except the following:

• WhoAmI
• RetrieveFilteredForms
• TriggerServiceEndpointCheck
• QueryExpressionToFetchXml
• FetchXmlToQueryExpression
• FireNotificationEvent
• RetrieveMetadataChanges
• RetrieveEntityChanges
• RetrieveProvisionedLanguagePackVersion
• RetrieveInstalledLanguagePackVersion
• RetrieveProvisionedLanguages
• RetrieveAvailableLanguages
• RetrieveDeprovisionedLanguages
• RetrieveInstalledLanguagePacks
• GetAllTimeZonesWithDisplayName
• GetTimeZoneCodeByLocalizedName
• IsReportingDataConnectorInstalled
• LocalTimeFromUtcTime
• IsBackOfficeInstalled
• FormatAddress
• IsSupportUserRole
• IsComponentCustomizable
• ConfigureReportingDataConnector
• CheckClientCompatibility
• RetrieveAttribute

How we categorize read and readmultiple

We use the prefix to categorize.

Example generated logs

The following are some examples of logs created with Activity Logging.

Example 1 – Logs generated when user reads an Account record

Example 2 – Logs generated when user sees Account records in a Grid (Export to Microsoft Excel logs are like this)

Example 3 – List of messages logged when user converts a lead to opportunity

Other considerations

When audit log search in the Microsoft Purview portal is turned on, user and activity from your organization is recorded in the audit log and retained for 90 days. However, your organization might not want to record and retain audit log data. Or you might be using a third-party security information and event management application to access your auditing data. In those cases, a global admin can turn off audit log search in Microsoft 365.

Known issues

• Office has a 3-KB limit for each audit record. Therefore, in some cases a single record from customer engagement apps needs to be split into multiple records in Office. The CorrelationId field can be used to retrieve the set of split records for a given source record. Operations that are likely to require splitting include RetrieveMultiple and ExportToExcel.
• Some operations need more processing to retrieve all relevant data. For example, RetrieveMultiple and ExportToExcel are processed to extract the list of records that are retrieved or exported. However, not all relevant operations are yet processed. For example, ExportToWord is currently logged as single operation with no other details about what was exported.
• In future releases, logging is disabled for operations deemed unnecessary based on a review of the logs. For example, some operations originate from automated system activity rather than user actions.
• In some record instances, the EntityName value may be marked with Unknown. These records aren't related to any specific entity related operation and came in blank from CRM. They all have entity ID of 0000000-0000-0000-0000-000000000000.

See also

Manage Dataverse auditing
Search the audit log in Microsoft Purview portal
Search the audit log for user activity using Office 365 Management APIs overview