Getting Started with Auditing in Dynamics 365 CRM

Auditing tracks user changes to Dynamics 365 CRM records and provides a valuable tool for investigating what has happened to data in your application. Auditing can help organizations streamline operations and support compliance requirements. Administrators and other authorized users can use the audit history to investigate data changes, troubleshoot problems, evaluate security, and identify opportunities to improve processes.

Why Audit Your CRM Data?

One common auditing scenario involves accidentally changed or deleted data. If an important record is deleted, audit history can provide information that helps an administrator understand what happened to the record. Situations like this can also reveal opportunities for process improvements, such as restricting users' ability to delete certain records through security roles or providing additional user training. Auditing is also useful when your organization uses automation or integrations. Records created, modified, or deleted by these processes can appear in the audit history, providing information that can help when troubleshooting unexpected behavior. Auditing can also support training and process improvement. If data is consistently entered incorrectly, audit history may help determine where additional training, automation, or changes to the data-entry process could help.

What Does Dynamics 365 Auditing Track?

CRM auditing tracks common record events, including:

• Creating records
• Updating records
• Deleting records

It can also track other events, including:

• Changes to CRM security roles
• Association or disassociation of many-to-many relationships
• Sharing records
• Deleting audit logs
• Users accessing the application
• Changes to auditing configuration

For example, auditing can capture when a Contact is added to a Marketing List or when a stakeholder is associated with an Opportunity.

What Doesn't the CRM Audit Log Track?

The CRM audit log doesn't capture every type of user activity. For example, activities such as exporting data aren't captured in the CRM audit log. Other Dataverse events fall under activity logging, which can be audited separately and reviewed through the Microsoft Purview Compliance Portal. This lesson focuses specifically on the Dynamics 365 CRM audit log.

Auditing Must Be Enabled

Auditing isn't turned on by default when provisioning a new Dynamics 365 environment. Your organization must opt into the functionality. One reason for this is that audit logs contribute to CRM storage capacity. Configuring auditing is primarily an administrator task. However, viewing audit information doesn't have to be restricted to administrators. CRM security roles can give other users permission to view audit history when appropriate.

View Audit History for an Individual Record

One convenient auditing feature is the ability to view audit history directly from an individual CRM record. To review a record's history:

1. Open the record.
2. Select the Related menu.
3. Find Audit History.
4. Open the Audit History tab.

The audit history displays the most recent events first and allows you to work backward through the record's history.

Understand the Audit History

The record-level Audit History provides information such as:

• The date and time of the change
• The user who made the change
• The type of event
• The field that changed
• The old value
• The new value

For example, if someone enters a phone number on an Account, the audit history can identify the user who made the update and show the new value. If the phone number is changed again later, the audit history can show both the previous value and the new value. Changes made during the same save operation can also be grouped together, making it easier to understand which updates happened at the same time.

Track Record Assignment

Audit history can also show when ownership of a record changes. If an Account is assigned from one user to another, the audit log displays an Assign event. Because assignment changes the record's owner, the audit information can show the previous owner and the new owner. This provides a historical record of how ownership has changed over time.

Track Record Sharing

Sharing produces a different type of audit event. Because sharing a record doesn't simply update one of the record's standard data fields, the Audit History may not display the same old and new field values that you see with an update. Instead, the Share event can be opened for additional details. Those details can show who the record was shared with and which privileges were granted, such as:

• Read
• Write
• Append
• Append To

This provides additional insight into changes to record-level access.

View Audit History Across the Application

In addition to reviewing audit history for a specific record, authorized users can review auditing information across the application. The system-wide Audit Summary View provides a broader picture of events happening throughout CRM. The list includes information such as:

• Date and time
• Event type
• The user responsible for the change
• Record name
• Table or entity
• Operation, such as Create, Update, or Delete

Like individual record history, the most recent events appear first.

Filter the System-Wide Audit Log

The Audit Summary View allows you to filter information using its available columns. For example, you could filter the list to focus specifically on Assign events. You can also open an audit event for additional information. An update to a record, for example, can be opened to see which fields were affected. When the corresponding CRM record still exists, you can also navigate to the record directly from the audit information.

Understand the Audit Summary View's Limitations

The Audit Summary View doesn't behave exactly like a regular Dynamics 365 list. There are several limitations to keep in mind:

• Users can't create custom views to save audit filters.
• Sorting is limited to the changed date column.
• Audit data can't be exported directly from the standard list.

If your organization needs more advanced access to this information, Microsoft makes audit data available programmatically through options such as the Web API and SDK.

Use Auditing to Better Understand Your CRM Data

Dynamics 365 auditing gives organizations a historical view of important events throughout CRM. At the individual record level, audit history can help answer questions such as who changed a field, what the previous value was, when ownership changed, or when access to a record was shared. At the application level, the Audit Summary View provides a broader look at activity across CRM and allows authorized users to investigate specific events. Used thoughtfully, this information can support troubleshooting, security, compliance, user training, automation, integration monitoring, and ongoing improvements to your CRM processes.