Which workloads log what, and for how long.
When something has happened, the first question is who did what, and when. We look at how Exchange, SharePoint, OneDrive, Teams, Entra ID, Purview and Copilot feed the unified audit log, what's logged elsewhere, like Entra sign-in logs and Entra ID Protection, how long each license keeps the records, and the three ways to get them out.
Step through More in Investigate logs and user activity
These videos have no narration — the sound is background music and interface clicks. Step through presents the same content as text.