ComplianceAudit
The audit trail a tenant scan should leave behind
If you are running scans on live production tenants, "trust me, it was read-only" is not enough. Here is what a defensible audit trail looks like — for your security team and for a customer regulator.
LogiSam EngineeringThe team behind TSO25 May 20265 min read
When a security team asks "what exactly did that scan do", the honest answer is a log. Not a summary, not a promise — a per-request log of every Graph call, when, by whom, for what.
What TSO logs
- Every Graph request — method, URL template (never the parameters that include site or user IDs), timestamp, HTTP status.
- Every scan action — who started it, which tenant, which workloads selected, duration, outcome.
- Every export — who downloaded the PDF or Excel, which scan, when.
- Every consent grant and revoke — who authorised, when, which scopes.
What TSO deliberately does not log
- Individual file names, paths or user identities — those live in the scan results table, protected by workspace RBAC.
- Response bodies from Graph — logging them would be a large attack surface with no operational benefit.
- Request headers containing tokens — never appear in the audit trail.
On the Enterprise and MSP tiers the audit log is exportable as JSON so you can pipe it into your SIEM. Customers who have been through a SOC 2 review with TSO typically hand this to their auditor and are done.