Directory evidence for an audit answers three questions: what the structure was at a point in time, what changed between two points, and whether the evidence itself can be trusted. Most tenants can answer none of the three without preparation, because Entra ID shows current state, not history.
What auditors actually ask for#
Recurring requests from access and license audits map to directory history:
- The membership and licensing state as of a specific date, not today.
- Every structural change in the audit window, attributable and complete.
- Evidence files whose origin and integrity can be verified, not screenshots.
The manual preparation trap#
Teams without point-in-time captures reconstruct history from the audit log, which has finite retention and records events rather than states. Turning an event stream back into the full hierarchy as it stood on a date is days of work per audit, repeated every audit.
The durable fix is to capture snapshots on a schedule, so any past state is a lookup and any change window is a diff between two captures.
VisualizerEngine
How VisualizerEngine does it
Point-in-time snapshots capture the directory's structure, memberships, and license assignments. Any two snapshots diff into an exact change list, and compliance exports carry provenance metadata plus an integrity trailer so the report is traceable to its source data. The tamper-evident audit trail adds an HMAC-chained record of actions inside the platform itself.