Reading a Fabric audit log to see who did what
Microsoft Fabric user and admin activities are recorded in the unified Microsoft Purview audit log, which captures actions across Fabric items like workspaces, lakehouses, pipelines, and reports. Fabric admins and compliance officers use this audit trail to monitor usage, investigate security incidents, and meet regulatory requirements. Access to audit data is controlled through Microsoft Purview and Fabric admin portal settings, requiring appropriate licensing and permissions.
Must-know
- Fabric audit logs are part of the unified Microsoft 365/Purview audit log, searchable via the Purview compliance portal or Audit (Standard/Premium) solutions.
- Tenant admins must enable audit log search in the Microsoft 365 admin center or Purview compliance portal before Fabric activity events can be recorded and retrieved.
- Fabric-specific operations (e.g., workspace creation, item read/edit/delete, sharing, and capacity changes) appear as distinct RecordType/Operation values that can be filtered in audit log searches.
- Retention and search history depend on licensing tier: Microsoft Purview Audit (Standard) typically retains logs for a shorter period than Audit (Premium), which extends retention and adds high-value events.
- Audit log data can be accessed programmatically via the Office 365 Management Activity API for integration with SIEM tools or custom monitoring solutions.
- Fabric admin settings (Admin portal > Tenant settings) control whether certain audit-related features, like usage reporting or activity events, are enabled at the tenant or capacity level, and these settings can take time to propagate.
A compliance analyst at a company needs to identify every user who opened a specific sensitive semantic model in a Fabric workspace during the past week. The Fabric admin portal tenant settings do not provide this level of detail. Which tool should the analyst use to retrieve this information?
What you have tried across DP-700's objectives, not a readiness score.
Implement and manage an analytics solution
- Tuning a workspace's Spark compute defaults and pool sizing
- Grouping and governing workspaces with a Fabric domain
- Setting per-workspace defaults for OneLake storage
- Standing up an Airflow job runtime inside a workspace
- Connecting a workspace to a Git repository
- Managing schema changes with a database project
- Promoting Fabric items across environments with a deployment pipeline
- Granting and restricting access at the workspace level
- Locking down who can open a single Fabric item
- Layering row, column, object, and file-level security rules
- Hiding sensitive column values behind a dynamic mask
- Classifying Fabric items with a sensitivity label
- Marking a trusted item as promoted or certified
- Reading a Fabric audit log to see who did what
- Securing data at the OneLake storage layer
- Picking the right build tool among a dataflow, a pipeline, and a notebook
- Kicking off a job on a schedule or in response to an event
- Chaining notebooks and pipelines together with parameters and dynamic expressions
Ingest and transform data
- Deciding between a full reload and an incremental load
- Shaping source data ahead of a dimensional-model load
- Landing a continuous stream of data into storage
- Matching a workload to the right Fabric data store
- Picking a transformation tool from dataflows, notebooks, KQL, or T-SQL
- Linking to external data without copying it via a OneLake shortcut
- Keeping a source database continuously replicated into Fabric
- Moving data into Fabric with a data pipeline
- Writing transform logic in PySpark, SQL, or KQL
- Flattening related tables into one wide, denormalized shape
- Rolling records up with group-by aggregations
- Dealing with duplicate rows, gaps, and data that arrives late
- Selecting the right engine for a real-time workload
- Weighing storage-in-place against a linked shortcut for a Real-Time Intelligence table
- Weighing an accelerated shortcut against a standard one for query speed
- Routing and reshaping live events with an Eventstream
- Handling a continuous flow of records with Spark's structured streaming
- Querying and reshaping event data with KQL
- Aggregating a stream over sliding or tumbling time windows
Monitor and optimize an analytics solution
- Watching an ingestion job's health and progress
- Watching a transformation job's health and progress
- Tracking whether a semantic model's refresh actually succeeded
- Setting up an alert to catch a failure early
- Tracking down why a pipeline run failed and fixing it
- Diagnosing why a dataflow run failed
- Debugging a notebook run that failed
- Troubleshooting a misbehaving Eventhouse
- Troubleshooting a misbehaving Eventstream
- Debugging a T-SQL statement that failed
- Fixing a broken or unreachable shortcut
- Speeding up a Lakehouse table with maintenance operations
- Making a slow pipeline run faster
- Tuning a Fabric warehouse for faster queries
- Improving throughput on real-time streaming components
- Tuning a Spark job to run faster and cheaper
- Making a slow query run faster
Coverage checked against the published exam guide on Aug 11, 2026.
These are independent practice questions, written against this certification's published exam guide. They are not the certification vendor's own questions, and not the real exam.