Reading a Fabric audit log to see who did what

Microsoft Fabric user and admin activities are recorded in the unified Microsoft Purview audit log, which captures actions across Fabric items like workspaces, lakehouses, pipelines, and reports. Fabric admins and compliance officers use this audit trail to monitor usage, investigate security incidents, and meet regulatory requirements. Access to audit data is controlled through Microsoft Purview and Fabric admin portal settings, requiring appropriate licensing and permissions.

1 · Learn the must-know

• 1Fabric audit logs are part of the unified Microsoft 365/Purview audit log, searchable via the Purview compliance portal or Audit (Standard/Premium) solutions.
• 2Tenant admins must enable audit log search in the Microsoft 365 admin center or Purview compliance portal before Fabric activity events can be recorded and retrieved.
• 3Fabric-specific operations (e.g., workspace creation, item read/edit/delete, sharing, and capacity changes) appear as distinct RecordType/Operation values that can be filtered in audit log searches.
• 4Retention and search history depend on licensing tier: Microsoft Purview Audit (Standard) typically retains logs for a shorter period than Audit (Premium), which extends retention and adds high-value events.
• 5Audit log data can be accessed programmatically via the Office 365 Management Activity API for integration with SIEM tools or custom monitoring solutions.
• 6Fabric admin settings (Admin portal > Tenant settings) control whether certain audit-related features, like usage reporting or activity events, are enabled at the tenant or capacity level, and these settings can take time to propagate.

2 · Check your understanding