The audit trail you think you have

The auditor's question is always the same: Who gave this user access to this resource, when, on what grounds, and who approved it? The question is simple. Answering it is not, and it is useful to understand exactly where it breaks down.

Retention is shorter than you think, and P2 does not help

Entra ID's built-in log retention:

Note that P2 does not give longer retention on audit and sign-in logs than P1. Both give 30 days. The difference lies solely in risky sign-ins. This is routinely misunderstood in budget discussions — you upgrade to P2 and believe you have bought traceability.

Thirty days is shorter than a quarterly audit, shorter than most incident investigations, and considerably shorter than the period between access being granted in error and someone discovering it.

Worse: retention changes are not retroactive. If you upgrade from Free to P1 because the auditor asked for it, you only bring the last 7 days with you. What has expired is gone.

Longer storage is an Azure project, not a setting

If you want more than 30 days, the logs must be exported via Azure Monitor diagnostic settings to a Log Analytics workspace, Storage account or Event Hubs. That is not a checkbox — it is an Azure subscription, a workspace design, a retention policy and a running cost. Log Analytics has a default interactive retention of 30 days, a maximum of 730 days interactive, and up to 4,383 days (12 years) with long-term archive.

Microsoft Graph Activity Logs is the log that actually shows what was done to the directory via the API — every HTTP request Graph receives for the tenant, from LOB applications, SDKs, PowerShell, admin portals and AI clients. It requires P1 or P2, a Security Administrator to configure diagnostic settings, and an Azure subscription. It has no retention in the portal at all — it exists only if you route it somewhere.

The volume is not trivial. Microsoft's own figures: roughly 14 GiB per month at 1,000 users, and roughly 1,000 GiB per month at 100,000 users. That is a real budget line, not a footnote.

The three-part trail

Even with perfect logging and a twelve-year archive, the structural problem remains: the decision, the justification and the execution live in three different systems.

1. The business justification lives in the case management system — a ticket in ServiceNow, Jira or Zendesk, often with free text such as "New project manager, needs access to Project Nord".

2. The approval lives in email, a Teams thread or an approval button in the case management system — often with a wording that does not precisely bound what was approved.

3. The execution lives in the Entra audit log, which shows that user object X was added to group Y at 14:32 by administrator Z — without any reference to a ticket number or approver.

Answering the auditor means correlating these three manually, per event, often across systems with different timestamping and different retention. The correlation key is at best a ticket number someone remembered to paste into a comment field.

There is no technical link. It exists only in the heads of the people who were there.

Why it is more urgent now

Section 10 of the Digital Security Regulations (digitalsikkerhetsforskriften), in force in Norway since 1 October 2025, requires «styring av og kontroll med tilganger» [Unofficial translation: "management of and control over access"] and segmentation «basert på minste privilegiums prinsipp» [Unofficial translation: "based on the principle of least privilege"] for providers of essential services. Section 12 requires that the undertaking «følge[r] opp at personell ikke har flere tilganger enn nødvendig» [Unofficial translation: "follow[s] up that personnel do not have more access rights than necessary"]. Follow-up that cannot be documented is hard to distinguish from follow-up that has not happened.

GDPR Article 5(2) puts it even more sharply: the controller shall be responsible for and "be able to demonstrate compliance". Missing documentation is itself the non-conformity.

The decision by the Norwegian Data Protection Authority (Datatilsynet) against the University of Agder in September 2024 — NOK 150,000, around 16,000 data subjects affected, employees with access without a legitimate business need for six years — illustrates the point. The non-conformity did not consist in someone misusing the access. It consisted in the access existing.

What this means for Entra Logic

Entra Logic makes the three threads one record. The request carries the business justification. The approval decision hangs on the same record. The execution engine runs against Microsoft Graph from the same record, and the result is written back to it. There is no correlation job, because three separate trails that had to be correlated never arose.

It also means that bulk operations retain traceability: a reorganization affecting 300 accounts is executed as one operation, but every individual change gets its own accountable order — a request that carries its own approval and execution — in contrast to a freehand PowerShell script, which leaves 300 identical lines in the audit log without justification and without an approver.

A clarification, since the market confuses this: Entra Logic is not an attestation or certification product. It does not run periodic recertification campaigns. What it does is ensure that every individual change is justified, approved and executed as one coherent, searchable event — which is a different and more fundamental thing.

—

Sources

• Microsoft Learn — Data retention for Microsoft Entra monitoring and health
• Microsoft Learn — Microsoft Graph activity logs overview
• Microsoft Learn — Configure data retention in Log Analytics
• Lovdata — Digitalsikkerhetsforskriften (FOR-2025-06-20-1131) (the Digital Security Regulations)
• EUR-Lex — Forordning (EU) 2016/679 (GDPR) (Regulation (EU) 2016/679)
• Datatilsynet — Overtredelsesgebyr til Universitetet i Agder (administrative fine issued to the University of Agder)