Exporting D365 F&O security logs to Azure Log Analytics for immutable retention

(1) Share

Report

Posted on by Huma Selot CU200816...

148

To meet strict regulatory compliance, we need to export D365 F&O security event logs (e.g., user role assignments, system administrator access, and critical security configuration changes) into Azure Monitor and a Log Analytics workspace for long-term, immutable retention.

What is the recommended architecture for this? Specifically:

Does the native Application Insights / Telemetry integration capture these specific security and role modification events out-of-the-box, or do we need to rely on custom Business Events and Database Logging routed through Dataverse?
How are you enforcing WORM (Write Once, Read Many) immutability on the destination side—are you using Log Analytics retention locks, or is it better to route the telemetry to an immutable Azure Storage Blob?
Are there any community-recommended KQL queries or standard workbooks for parsing F&O security telemetry once it reaches Azure Monitor?

Categories:

Dynamics 365 Finance

I have the same question (0)

All responses (1)

Answers (0)

Suggested answer

Assisted by AI

CU-1234529-002 242 on at

Like (0)

Report
Copy link

Link copied!

Hi,
Good question, breaking this into parts:
Native App Insights: Doesn't fully cover this out of the box : it's great for performance/usage telemetry, but not built for security/role-change auditing specifically. For that, D365FO has a separate audit trail on the security role form (timestamp, event type, user, object) : that's your real source for role/security changes, not App Insights.
Recommended approach: Pair Database Logging on the relevant security tables with Business Events, and route those into Azure Service Bus/Event Hub → Log Analytics. This gives you an actual event trail for security changes rather than relying on general telemetry.
On WORM immutability: I'd lean toward immutable Azure Blob Storage (with a time-based retention policy) as your true compliance record, rather than relying solely on Log Analytics retention, that controls how long data is kept, not true write-once immutability. Common pattern: stream to Log Analytics for querying/alerting, archive a copy to immutable Blob for the tamper-proof trail.
On KQL/workbooks: Haven't come across a standard community workbook for this specific use case, most published queries are for performance telemetry, not security events. You'll likely need to build custom KQL against your Business Event tables once they land in Log Analytics.
Curious if anyone else here has already built a Business Events → Log Analytics pipeline for security auditing : would be great to compare notes.

Thanks!

Was this reply helpful? Yes No