Single record and multiple record auditing in Dynamics 365 to Audit record access | M365 Compliance

One of the most important asks for organizations who are sensitive about tracking their data is – Which records are accessed by the user?
There’s a powerful tool in Compliance Center i.e. Audit that can record this as to when a certain D365 record was accessed and all the details about the same.

What is recorded?

Single record – Only access to Dynamics 365 record opening will be audited/captured.

Multiple record – Access to Dynamics 365 record as well as other controls that were in context of the record like sub-grid controls, timeline controls etc. will be audited/captured.

Pre-requisites

The User whose D365 Record Opening activities are to be logged must either have a O365 / M365 Enterprise E3 / E5 License assigned to them.
The environment should be a Production one.

Turn on Recording of Audit (Dynamics 365 & M365 Compliance Center)

Now, to be able to record Auditing of User Record Access, you’ll need to make sure the Auditing is turned ON at these places –

In Dynamics 365, make sure the Auditing is turned ON at the Global Level and that Audit Read Access is enabled too.
Next, make sure the entity’s whose record access you want to capture should have their Auditing as well as Single and/or Multiple Record Access Auditing turned ON as well.
Now, the M365 Admin Center (https://compliance.microsoft.com/) should also be enabled for recording the Audit of User access. This will start recording User and Admin Activity.

It’ll ask for confirmation and then start updating. In my experience, this failed a few times and I wasn’t able to know for sure when it actually got enabled.

Then, it takes a few moments

In my case, this resulted in an error.
Now, I’m not sure if I missed anything although I made sure everything was correct. And when I checked after some time, it was enabled even without me retrying it. But it could just be for me and might work correctly for you.

Recording of Auditing

Let’s test a scenario where a User is not an Admin User and they try to access the Account record on which we’ve enabled Single and Multiple User Access Auditing –

Please note that it takes about 3-4 hours to the log information to be available in (https://compliance.microsoft.com/homepage)

Now, if you navigate to Audit and search.
Make sure your criteria is as narrow as possibly by including only the user you really want to find if that’s the case
In my scenario, I was logged in as Priyesh Wagh user and opened a record in CRM.

So, just to look at what all was logged, my search criteria will look like this –
I’ll make sure All Dynamics 365 Activities is selected if you want to look at everything which is D365 CRM related.
Next, since I’m only looking for my own user who opened the CRM record, I’ll search and select the user in the below filter.
Not to mention the time frame is also narrowed to get limited results. 😊
Here, my results will show up.

If I zoom on in, I’ll see the different types of logs that are filed in the Compliance Center – The retrieve Account is the actual record where all the other events are registered based on the different controls that were loaded when I opened the record itself.
In my experiment, I opened the same record twice, so it recorded the Retrieve account twice along with other event logs.
If I open the record, I’ll see this info about everything that was tracked along with the link to the record as well –