Microsoft Copilot
Glossary
Audit trail
An audit trail is the chronological, tamper-evident record of who did what, when, and to which resource across a system.
Also known as: audit log, activity log
What it records in Microsoft 365
In Microsoft 365, the audit log in Microsoft Purview records user and admin activity across the services: sign-ins, file access and sharing, permission grants, configuration changes and administrative actions. Retention depends on licence and policy, so older events may no longer exist when an auditor asks for them.
Why regulators ask for it
An audit trail answers a simple question after the fact: who did what, when, and to which resource. Frameworks such as DORA and NIS2 require you to show control over time. A complete, retained and tamper-evident trail is what connects a policy on paper to what actually happened in the tenant.
The same applies to governance decisions. An access review that was approved, a workspace that was archived, or an owner who was replaced should each leave a record that someone outside IT can follow.
Where Rencore fits
Rencore records its own governance activity, such as access review decisions, policy changes and automation runs, in an audit log, so the actions taken on your tenant are attributable and can be shown to an auditor next to Microsoft's own logs.