Configure audit logging

Audit logging requires a workspace-based Application Insights resource connected to a Log Analytics workspace. Identity uses the Application Insights connection string to ingest governance events and the workspace ID to read those events in EasyLife 365 Admin.

If you only need to send events for retention or external analysis, configure ingestion mode. To view logs in the application details panel, configure both ingestion mode and reading mode.

info

Learn about audit logging, the events, and troubleshooting activities here.

Create the Azure resources

1. Open the Azure portal and select the subscription where you want to store Identity audit events.
2. Create an Application Insights resource.
3. Select Workspace-based as the resource mode.
4. Under Workspace Details, select an existing Log Analytics workspace or create a new one.
5. Create the resource.

Adjust Log Analytics retention

Application Insights data types retain information for 90 days by default, after which they follow the workspace retention period when it is longer. To configure a retention period of up to 730 days:

1. Open the Application Insights resource and go to its overview page.
2. Follow the link to the associated Log Analytics workspace.
3. In the workspace, open Usage and estimated costs.
4. Under Daily cap, find Data Retention (Days).
5. Set the retention period required by your organization.

Enable ingestion mode

1. Open the Application Insights resource in the Azure portal.
2. On the overview page, copy the Connection string.
3. Open EasyLife 365 Admin.
4. Go to Settings -> Logging.
5. Enable Enable audit logging.
6. Paste the value into Application Insights connection string and save the settings.

info

When the connection string changes, it can take up to 24 hours for the new setting to propagate.

Enable reading mode

Reading mode requires the Log Analytics workspace ID and the Log Analytics Reader role for the EasyLife app.

1. On the Application Insights overview page, open the associated Log Analytics workspace.
2. Copy the Workspace ID from the workspace overview page.
3. In the workspace, open Access control (IAM).
4. Select Add -> Add role assignment.
5. Select the Log Analytics Reader role and continue.
6. Under Members, select Select members and search for the EasyLife app used by your tenant.
7. Select Review + assign to grant the role.
8. Open EasyLife 365 Admin and go to Settings -> Logging.
9. Paste the value into Log Analytics workspace ID and save the settings.

Once both modes are configured and audit logging is enabled, open an application's details panel from Admin -> Manage and select Logs to review its events.