The Entra audit log answers who did what, when: it is the event record and nothing replaces it for attribution. The comparison is about the questions an event stream cannot answer directly, which are the state questions audits actually ask.
What the audit log is for#
Attribution and forensics: which account performed an operation, from where, when. For investigating a specific change, the audit log is the source of truth, and VisualizerEngine does not replace it.
Events versus states#
The structural questions live in a different shape of data:
- What did the hierarchy look like on March 1? An event stream answers only by replaying every event since a known state, which is manual, error prone, and bounded by retention.
- What changed between two dates? Extractable from events in principle, but membership events say a user joined a group, not that five hundred users thereby gained new transitive access.
- Are we compliant with our own structure rules? Events do not evaluate policies; something must interpret the current state.
Retention is the deadline#
Audit log retention is finite. Whatever the log holds today, questions about periods beyond retention answer only from records you captured yourself, which is the argument for scheduled point-in-time captures independent of the event stream.
VisualizerEngine
What VisualizerEngine adds
Point-in-time snapshots make historical state a lookup, diffs between any two snapshots produce complete structural change lists, and the policy engine evaluates compliance continuously. Inside the platform, its own append-only, HMAC-chained audit trail records every administrative and read action with tamper-evident verification.