Track permission changes from Unified Audit Log for security monitoring and compliance.
Related topics
permission audit
audit log
access changes
security monitoring
change tracking
About this tool
The Permission Change Audit tool tracks permission modifications from the Microsoft 365 Unified Audit Log. Monitor who granted or revoked access, when changes occurred, and what permissions were affected.
Essential for security monitoring and incident investigation. Identify unauthorized permission changes and track the chain of access modifications.
Export audit data for compliance documentation and forensic analysis.
Key features
Permission grant tracking
Access revocation history
User activity timeline
Sharing link creation
Role assignment changes
Forensic investigation support
Date range filtering
Export for analysis
Use cases
.
.
.
Graph scopes
undefined (application).
Tool identity
Slug: permission-audit.
Category: audit.
Plan tier: pro.
Editions: cloud, desktop.
SKUs: security, suite.
Related workloads inside the toolkit
Exchange Online mailbox backup.
SharePoint sharing audit.
OneDrive quota review.
Intune device configuration export.
Entra ID role exposure scan.
Conditional Access policy snapshot.
Purview retention label inventory.
Planner board export.
Bookings calendar snapshot.
Defender alert correlation.
Compliance evidence package builder.
Vault rotation log review.
Cross-tenant context
Workloads sync across cloud regions. Frankfurt. Dublin. Amsterdam. Stockholm. Paris. North America. Pricing publishes once. Cancellation lands inside one settings page. Cipher suite covers Argon2id. XChaCha20-Poly1305. X25519. Ed25519. Audit log retention: 90 days. Migration record set in 2025: 153,584 files. Zero errors.