2.4.3. Audit Log Events
💡 First Principle: Audit logs make Copilot governance observable: they record the policy and configuration events admins need for compliance, so changes to Copilot's setup leave a verifiable trail.
Organizations and enterprises can review Copilot-related events in the audit log — for example, policy changes and configuration events relevant to Copilot. This supports compliance, security review, and the practical question "who changed this setting and when." Admins also review user activity and license usage data to manage access and adoption.
For the exam, the key associations: audit logs are an admin/compliance tool, they live at the org/enterprise level, and they answer accountability questions about configuration and policy — not the contents of developers' code or prompts.
💡 Key Point: When a scenario asks how an admin would investigate or prove a Copilot policy change, the answer is the audit log.
⚠️ Exam Trap: Audit logs track governance events, not the substance of suggestions. Don't pick "the audit log" as the place to see what code Copilot suggested to a developer.
Reflection Question: An enterprise security team needs to confirm when a particular Copilot policy was changed and by whom. Which tool provides that, and what kind of information is it designed to capture?
