BasicProfessional

Audit logging settings

Audit logging records governance actions performed by administrators and by application owners. The events are sent to Azure Application Insights and stored in the connected Log Analytics workspace, where they can be retained and reviewed as evidence for compliance and ownership governance.

For the Azure resource setup and the required permissions, see Configure audit logging.

Configure audit logging

The Logging section is available in EasyLife 365 Admin under Settings. Configure the following fields in loggingSettings.events:

• Enable audit logging (isEnabled) - Enables Identity audit event recording. When enabled, Identity sends events to the Application Insights resource configured below.
• Application Insights connection string (connectionString) - The connection string for a workspace-based Application Insights resource. This is the ingestion mode setting and is required to send audit events.
• Log Analytics workspace ID (workspaceId) - The ID of the Log Analytics workspace associated with Application Insights. This is the reading mode setting and, together with Log Analytics Reader permission for the EasyLife app, allows administrators to view logs in EasyLife 365 Admin.

Changes to the Application Insights connection string can take up to 24 hours to propagate.

warning

To read logs in EasyLife 365 Admin, configure the Log Analytics workspace ID and grant the EasyLife app the Log Analytics Reader role on the workspace. Without reading mode, Identity can still send events when ingestion mode is configured, but the application cannot display the audit history.

View application logs

Audit history is shown in the Logs section of the application details panel:

1. Open EasyLife 365 Admin and go to Admin -> Manage.
2. In the App Registrations or Enterprise Applications list, select the Show details (information) button for an application.
3. In the application details panel, open Logs. The panel also contains Details, Business Owners, Technical Owners, Application Owners, and Compliance sections.
4. Review the audit records. Entries are displayed chronologically, with the newest events first.

The Logs section is available for the selected application when tenant audit logging is enabled and reading mode is configured. Identity loads the history for that application's object ID and can show loading, unavailable, or permission-denied states when the workspace cannot be read.

Microsoft 365 Audit Logs

In addition to EasyLife event logging, Microsoft 365 Audit Logs can be used to investigate app and user activity in your tenant. Use Microsoft 365 audit search with filters for EasyLife 365 applications when you need Microsoft 365 activity beyond the governance events listed below.

Available events

The following section outlines all events tracked through the audit logging feature, categorized by capability area.

The headings below group events by where the action happens: Admin Activities are actions triggered and executed through an admin-only API, under the Bearer-Admin authentication scheme — reachable from EasyLife 365 Admin, and for some operations also directly from an app-only integration (for example the ownership API). Everything else is a User Activities action: reachable by any authenticated app owner the permission check authorizes, whether they act from EasyLife 365 Admin's Manage views or from EasyLife 365 Identity — the same endpoint serves both. Engine Activities are the background service acting without a person present. Identity currently has no engine-triggered activities of its own, so no capability area below lists one.

The Category column follows the same rule: ADMIN only on events written from an admin-only endpoint, ACCOUNT everywhere else.

Application management

Admin Activities

Category	EventId	Description
POLICY	ASSIGN-POLICY	An admin assigns a policy to an application
POLICY	REMOVE-POLICY	An admin removes a policy from an application
ADMIN	DELETE	An admin deletes an application
ADMIN	ENABLE	An admin enables an application's sign-in, from the bulk actions in EasyLife 365 Admin's Manage views
ADMIN	DISABLE	An admin disables an application's sign-in, from the bulk actions in EasyLife 365 Admin's Manage views
ADMIN	ASSIGN-OWNER	Adds an application owner, via the ownership API or its use from EasyLife 365 Admin
ADMIN	REMOVE-OWNER	Removes an application owner, via the ownership API or its use from EasyLife 365 Admin
ADMIN	ADD-TECHNICAL-OWNER	Adds a technical owner to an application, via the ownership API or its use from EasyLife 365 Admin
ADMIN	REMOVE-TECHNICAL-OWNER	Removes a technical owner from an application, via the ownership API or its use from EasyLife 365 Admin
ADMIN	ADD-BUSINESS-OWNER	Adds a business owner to an application, via the ownership API or its use from EasyLife 365 Admin
ADMIN	REMOVE-BUSINESS-OWNER	Removes a business owner from an application, via the ownership API or its use from EasyLife 365 Admin

User Activities

Category	EventId	Description
ACCOUNT	ASSIGN-OWNER	Adds an application owner
ACCOUNT	REMOVE-OWNER	Removes an application owner
ACCOUNT	ADD-TECHNICAL-OWNER	Adds a technical owner to an application
ACCOUNT	REMOVE-TECHNICAL-OWNER	Removes a technical owner from an application
ACCOUNT	ADD-BUSINESS-OWNER	Adds a business owner to an application
ACCOUNT	REMOVE-BUSINESS-OWNER	Removes a business owner from an application
ACCOUNT	ENABLE	An application's own owner enables its sign-in, from Security Center or Settings
ACCOUNT	DISABLE	An application's own owner disables its sign-in, from Security Center or Settings
ACCOUNT	UPDATE-ASSIGNMENT-REQUIRED	An application's own owner changes whether the application requires user assignment
ACCOUNT	EXTEND-INACTIVITY	An application's own owner resets its inactivity clock from the Inactivity card in Security Center
ACCOUNT	ADD-CREDENTIAL	Adds an application credential
ACCOUNT	ROTATE-CREDENTIAL	Rotates an application credential
ACCOUNT	REMOVE-CREDENTIAL	Removes an application credential
ACCOUNT	GENERATE-SAML-CERTIFICATE	Generates a SAML certificate
ACCOUNT	UPLOAD-SAML-CERTIFICATE	Uploads a SAML certificate
ACCOUNT	ACTIVATE-SAML-CERTIFICATE	Activates a SAML certificate
ACCOUNT	DELETE-SAML-CERTIFICATE	Deletes a SAML certificate

Six event ids are shared between the two tables, because two independent code paths can make the same change: the Owners panel in EasyLife 365 Admin and EasyLife 365 Identity calls the same non-admin-only endpoint either way (ACCOUNT, regardless of which app the caller used), while the ownership API — an admin-only, Bearer-Admin endpoint also usable directly by an app-only integration — writes the identical ASSIGN-OWNER/REMOVE-OWNER/ADD-TECHNICAL-OWNER/REMOVE-TECHNICAL-OWNER/ADD-BUSINESS-OWNER/REMOVE-BUSINESS-OWNER ids under ADMIN. ENABLE/DISABLE are shared the same way: the admin bulk action and the app owner's own toggle update the same property and share the same ids, distinguished only by Category.

Operations without an audit trail

A few real, implemented actions do not currently write an audit event. This list reflects gaps in current coverage, not an intentional design decision:

• Bulk CSV import (Admin -> Manage -> Import) applies policy, owner, sign-in, and assignment-required changes to many applications from a single file. That path writes directly to Microsoft Graph and to the application's settings, bypassing the code that records ASSIGN-POLICY/REMOVE-POLICY, ASSIGN-OWNER/REMOVE-OWNER, ENABLE/DISABLE, and UPDATE-ASSIGNMENT-REQUIRED when the same changes are made one at a time from the Manage views or the application detail panel.
• Triggering an on-demand scan — the Start scan button in Scans settings runs an immediate credential-expiration scan.

Collected Values

Each event entry contains: DisplayName, Category, EventId, PreviousValue, NextValue, Description, CreatedBy, Created, Product, and CorrelationId. The event is always read in the context of the application it belongs to, so the application's own object ID is not repeated on every entry.