Auditing on JP’s Scratchpadhttps://scratchpad.ravensberg.org/tags/auditing/Recent content in Auditing on JP’s ScratchpadHugoen-USJean-Paul van RavensbergTue, 15 Sep 2026 18:20:00 +0000Purview Audit Search: who acted, and on what?https://scratchpad.ravensberg.org/posts/how-microsoft-365-services-write-audit-records/Tue, 15 Sep 2026 18:20:00 +0000https://scratchpad.ravensberg.org/posts/how-microsoft-365-services-write-audit-records/The identity performing an action is not necessarily the mailbox being accessed.