This post is a part of the DP-700: Implementing Data Engineering Solutions Using Microsoft Fabric Exam Prep Hub.
This topic falls under these sections:
Implement and manage an analytics solution (30–35%)
--> Configure security and governance
--> Implement and use Microsoft Fabric audit logs
Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 2 practice tests with 60 questions each available from the hub's main page below the exam topics section.
Introduction
As organizations adopt Microsoft Fabric for enterprise analytics, data engineering, and business intelligence workloads, maintaining visibility into user activity becomes increasingly important. Administrators and governance teams need to answer questions such as:
- Who accessed a specific report?
- Who deleted a workspace item?
- When was a dataset modified?
- Which users shared sensitive information?
- What actions were performed during a security incident investigation?
Microsoft Fabric Audit Logs provide a detailed record of user and administrative activities across the Fabric environment. These logs are essential for governance, security monitoring, compliance reporting, operational troubleshooting, and forensic investigations.
For the DP-700 exam, you should understand what audit logs are, how they work, what information they capture, where they can be accessed, and how they support security and governance requirements.
What Are Microsoft Fabric Audit Logs?
Audit logs are records of activities performed within Microsoft Fabric.
They capture information about:
- User actions
- Administrative actions
- Security-related events
- Content access
- Item modifications
- Sharing activities
- Workspace operations
Audit logs provide a historical record that organizations can use for monitoring and investigation purposes.
Why Audit Logging Is Important
Audit logging helps organizations:
- Monitor user activity
- Detect suspicious behavior
- Support compliance requirements
- Investigate security incidents
- Verify governance policies
- Track administrative changes
- Understand platform usage
Without audit logs, organizations have limited visibility into how Fabric resources are being used.
Types of Activities Captured
Microsoft Fabric audit logs can capture many types of events.
Examples include:
Workspace Activities
- Workspace creation
- Workspace deletion
- Workspace updates
- Membership changes
Item Activities
- Report creation
- Report deletion
- Dataset creation
- Semantic model updates
- Lakehouse modifications
- Warehouse modifications
Sharing Activities
- Sharing reports
- Sharing datasets
- Permission changes
- External sharing actions
Security Activities
- Role assignments
- Permission updates
- Access changes
- Governance actions
Administrative Activities
- Tenant setting modifications
- Capacity changes
- Configuration updates
Audit Log Architecture
A simplified workflow looks like this:
User Action ↓Fabric Records Event ↓Audit Log Entry Created ↓Administrator Reviews Activity
Every significant operation can generate an audit event that becomes part of the organization’s audit trail.
Information Captured in Audit Logs
A typical audit log entry may contain:
| Field | Description |
|---|---|
| Timestamp | When the action occurred |
| User | Who performed the action |
| Activity | What action occurred |
| Item Name | Object involved |
| Workspace | Location of activity |
| Operation Status | Success or failure |
| Additional Details | Context information |
Example:
Timestamp: 2026-01-15 10:42 AMUser: jsmith@contoso.comActivity: Deleted ReportReport: Executive DashboardWorkspace: FinanceStatus: Success
Microsoft Fabric and Microsoft 365 Audit Logs
Fabric auditing is integrated into the broader Microsoft ecosystem.
Audit events are available through Microsoft 365 audit capabilities, allowing organizations to centralize monitoring and investigation activities.
This integration provides:
- Unified auditing
- Centralized investigation
- Compliance support
- Enterprise-wide visibility
Common Audit Log Use Cases
Security Investigations
A sensitive report is accidentally deleted.
Administrators can review audit logs to determine:
- Who deleted the report
- When the deletion occurred
- Which workspace was affected
Compliance Audits
Regulators request evidence of access controls.
Audit logs provide historical records of:
- User access
- Permission changes
- Administrative actions
Governance Reviews
An organization wants to understand how frequently critical assets are used.
Audit logs can reveal:
- Access patterns
- Sharing activities
- Usage trends
Operational Troubleshooting
A workspace suddenly becomes unavailable.
Audit logs may identify:
- Recent configuration changes
- Role assignments
- Administrative actions
Audit Logs vs Monitoring Metrics
This distinction is commonly tested.
| Audit Logs | Monitoring Metrics |
|---|---|
| Who performed an action | Resource performance |
| Historical activity records | Capacity utilization |
| Security and governance focus | Performance focus |
| User behavior tracking | System behavior tracking |
Example:
Audit Log:
User deleted dataset
Monitoring Metric:
CPU utilization reached 85%
Audit Logs vs Activity Monitoring
Although related, they serve different purposes.
Audit Logs
Focus on:
- Security
- Governance
- Compliance
- User activity
Monitoring Tools
Focus on:
- Performance
- Capacity utilization
- Query execution
- System health
Audit Logs and Compliance
Audit logging plays an important role in regulatory frameworks such as:
- GDPR
- HIPAA
- SOX
- PCI DSS
- Internal governance standards
Organizations often require audit trails to demonstrate:
- Accountability
- Access monitoring
- Change tracking
- Security oversight
Key Security Benefits
Audit logs help organizations:
Detect Unauthorized Activity
Example:
Multiple unexpected permission changes
Investigate Security Incidents
Example:
Who accessed sensitive data?
Support Forensics
Example:
Timeline of events before a breach
Improve Accountability
Every action is associated with a user identity.
Common Audit Events for DP-700
Candidates should recognize events such as:
- Create Workspace
- Delete Workspace
- Update Workspace
- Create Report
- Delete Report
- Modify Dataset
- Share Content
- Change Permissions
- Update Tenant Settings
- Assign Roles
Audit Log Retention
Organizations should understand that audit logs are retained according to Microsoft and organizational retention policies.
Longer retention periods support:
- Compliance investigations
- Historical analysis
- Security reviews
Retention capabilities may vary depending on licensing and organizational configuration.
Best Practices
Enable Auditing
Ensure audit logging is enabled and properly configured.
Review Logs Regularly
Perform periodic reviews for:
- Security incidents
- Governance violations
- Unusual activity
Protect Audit Data
Audit logs themselves may contain sensitive information and should be protected appropriately.
Integrate with Security Processes
Use audit data alongside:
- Security monitoring
- Governance reviews
- Compliance audits
Establish Alerting Procedures
Monitor for:
- Unexpected permission changes
- Mass deletions
- Excessive sharing
- Administrative changes
Retain Logs Appropriately
Align retention periods with:
- Regulatory requirements
- Organizational policies
- Security needs
Common DP-700 Exam Scenarios
Scenario 1
A report is unexpectedly deleted.
Question:
How do you determine who deleted it?
Solution:
Review Microsoft Fabric audit logs.
Scenario 2
Management requests evidence showing who modified workspace permissions.
Solution:
Use audit logs to review permission-change events.
Scenario 3
A compliance auditor requests historical access records.
Solution:
Provide relevant audit log entries.
Scenario 4
An administrator wants to determine which users shared a sensitive dashboard.
Solution:
Review sharing-related audit events.
DP-700 Exam Focus Areas
You should understand:
✓ Purpose of audit logging
✓ Types of activities captured
✓ Security investigation scenarios
✓ Compliance use cases
✓ Governance monitoring
✓ Audit log contents
✓ Audit logs versus monitoring metrics
✓ Audit logs versus performance monitoring
✓ User activity tracking
✓ Administrative activity tracking
✓ Best practices for auditing
Practice Exam Questions
Question 1
What is the primary purpose of Microsoft Fabric audit logs?
A. To track user and administrative activities
B. To improve query performance
C. To optimize storage usage
D. To automate data ingestion
Answer: A
Explanation
Audit logs provide a historical record of user and administrative actions for governance, compliance, and security purposes.
Question 2
Which activity would most likely appear in a Fabric audit log?
A. CPU utilization reaching 90%
B. Network latency measurements
C. A user deleting a report
D. Spark memory allocation
Answer: C
Explanation
Audit logs capture user actions such as creating, modifying, sharing, and deleting Fabric items.
Question 3
A compliance auditor asks for evidence showing who changed workspace permissions last month.
Which feature should be used?
A. Audit logs
B. Capacity Metrics App
C. Query Insights
D. Spark Monitoring
Answer: A
Explanation
Audit logs record permission changes and can be used to identify who performed administrative actions.
Question 4
Which information is commonly included in an audit log entry?
A. CPU utilization percentage
B. Cluster memory consumption
C. Spark executor count
D. Timestamp, user, and activity performed
Answer: D
Explanation
Audit logs typically record who performed an action, when it occurred, and what operation was performed.
Question 5
A report was accidentally deleted. What is the best way to determine who deleted it?
A. Review workspace endorsements
B. Review sensitivity labels
C. Review audit logs
D. Review data lineage
Answer: C
Explanation
Audit logs provide detailed records of item deletion events and the users responsible for them.
Question 6
How do audit logs differ from monitoring metrics?
A. Audit logs track activities, while monitoring metrics track performance and resource usage.
B. Audit logs improve query performance.
C. Monitoring metrics identify user actions.
D. Monitoring metrics replace audit logs.
Answer: A
Explanation
Audit logs focus on user and administrative actions, whereas monitoring metrics focus on system and workload performance.
Question 7
Which scenario represents a common use of audit logs?
A. Scaling Spark clusters
B. Monitoring storage capacity growth
C. Determining who shared a sensitive report
D. Configuring deployment pipelines
Answer: C
Explanation
Audit logs capture sharing events and can be used to investigate who shared content.
Question 8
Which governance objective is best supported by audit logs?
A. Data compression
B. Accountability and traceability
C. Capacity scaling
D. Schema optimization
Answer: B
Explanation
Audit logs establish accountability by recording user actions and maintaining an activity history.
Question 9
Why are audit logs important during a security investigation?
A. They automatically restore deleted content.
B. They optimize warehouse performance.
C. They classify data sensitivity.
D. They provide a timeline of user and administrative activities.
Answer: D
Explanation
Audit logs help investigators reconstruct events and determine what actions occurred during a security incident.
Question 10
An organization wants to review all permission changes made during the last quarter.
Which Microsoft Fabric capability should be used?
A. Capacity Metrics
B. Query Monitoring
C. Audit Logs
D. Dataflows Gen2
Answer: C
Explanation
Audit logs record permission modifications and provide historical visibility into administrative actions.
Exam Tip
A frequent DP-700 exam challenge is distinguishing between audit logs, monitoring tools, and governance features.
Remember:
| Requirement | Solution |
|---|---|
| Determine who performed an action | Audit Logs |
| Monitor system performance | Monitoring Metrics |
| Track capacity utilization | Capacity Monitoring |
| Classify sensitive content | Sensitivity Labels |
| Identify trusted content | Endorsements |
If a question asks who did something, when it happened, or what changes were made, the correct answer is usually Audit Logs. If the question focuses on CPU, memory, performance, or utilization, the answer is likely a monitoring tool rather than auditing.
Go to the DP-700 Exam Prep Hub main page.
The Data Community 