Audit logs
Where Fabric activity is recorded, how long it lives, and how to get it into a SIEM for compliance.
Sources
| Source | Contents | Retention |
|---|---|---|
| Microsoft Purview / M365 unified audit log | User & admin activity across all of Fabric (view report, run notebook, change permission, create item) | 180 days (longer with add-on / E5) |
| Fabric Monitoring hub | Recent job runs, refreshes, pipeline executions | Rolling, short (days) |
| Capacity Metrics app | CU consumption by item and operation | ~14–28 days of detail |
| Workspace monitoring (Eventhouse) | Diagnostic logs (Spark, semantic model, eventhouse) into a KQL DB you own | You control it |
Pulling the unified audit log
Connect-ExchangeOnline
Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) `
-RecordType "PowerBIAudit" -ResultSize 5000 |
Export-Csv fabric-audit.csv -NoTypeInformationRecordType values include PowerBIAudit (covers Fabric) and specific ones
like FabricLakehouse, depending on tenant.
Workspace monitoring for engine-level detail
Enable Workspace settings → Monitoring. Fabric provisions an Eventhouse (KQL
DB) and streams diagnostic logs into it. Query with KQL:
SparkListenerApplicationEnd
| where Timestamp > ago(1d)
| summarize runs=count(), avg_duration=avg(DurationMs) by ItemName
| order by runs descRetain as long as you keep the Eventhouse — set a retention policy on the KQL database to match your compliance requirement.
A compliance-ready setup
Continuous export
Office 365 Management API → SIEM for the unified audit log. Do not rely on 180-day portal retention.
Workspace monitoring on regulated workspaces
Engine logs into an Eventhouse with an explicit retention policy (e.g. 400 days).
Alerting
In the SIEM: alert on permission changes to regulated workspaces, workspace identity changes, and OneLake security role edits.
Quarterly access review
Join audit "who read what" against role membership; recertify. Export the evidence.
The Capacity Metrics app is for cost/performance, not security — its retention is too short and its grain too coarse to be your audit trail. Use it alongside, not instead of, the unified audit log.
Stay ahead of Fabric changes
Fabric runtime changes, API updates, and deprecations. No spam, unsubscribe anytime.