Compliance needs a record of every time a specific Lakehouse holding embargoed donor records was opened, and by which accounts, to satisfy a retention audit. Where should the archives network's security team look for this activity trail?
Select an answer to reveal the explanation.
Short Explanation
Audit logs are the sign-in book at the archive's reading room door — every time someone opens that Lakehouse, it's logged with who and when, which is exactly what a retention audit needs to see.
Full Explanation
Fabric audit logs capture tenant-wide activity events, including when a specific item such as a Lakehouse is opened or otherwise accessed, and by which account, making them the correct place to satisfy a compliance retention audit asking 'who touched this and when.' The OneLake data access role list shows who is currently permitted to access the Lakehouse, which is a permissions snapshot, not a historical record of actual access events — a role assignment doesn't prove anyone used it, or when. Dynamic data masking configuration describes how column values are transformed for certain viewers; it contains no activity history at all. Sensitivity label metadata records the item's classification and protection settings, not a log of who opened the item. In practice, the security team would query the audit logs (surfaced through the Microsoft Purview compliance portal or the Fabric admin APIs) filtered to the Lakehouse's item ID and a date range, then export the matching access events for the auditor.