How to access the Global Secure Access (preview) audit logs

The Microsoft Entra audit logs are a valuable source of information when investigating or troubleshooting changes to your Microsoft Entra environment. Changes related to Global Secure Access are captured in the audit logs in several categories, such as traffic forwarding profiles, remote network management, and more. This article describes how to use the audit log to track changes to your Global Secure Access environment.

Prerequisites

To access the audit log for your tenant, you must have one of the following roles:

• Reports Reader
• Security Reader
• Security Administrator

Audit logs are available in all editions of Microsoft Entra. Storage and integration with analysis and monitoring tools may require additional licenses and roles.

Access the audit logs

There are several ways to view the audit logs. For more information on the options and recommendations for when to use each option, see How to access activity logs.

Access audit logs from the Microsoft Entra admin center

You can access the audit logs from Global Secure Access and from Microsoft Entra ID Monitoring & health.

From Global Secure Access:

1. Sign in to the Microsoft Entra admin center using one of the required roles.
2. Browse to Global Secure Access (preview) > Audit logs. The filters are pre-populated with the categories and activities related to Global Secure Access.

From Microsoft Entra monitoring and health:

1. Sign in to the Microsoft Entra admin center using one of the required roles.
2. Browse to Identity > Monitoring & health > Audit logs.
3. Select the Date range you want to query.
4. Open the Service filter, select Global Secure Access, and select the Apply button.
5. Open the Category filter, select at least one of the available options, and select the Apply button.

Save audit logs

Audit log data is only kept for 30 days by default, which may not be long enough for every organization. You may also want to integrate your logs with other services for enhanced monitoring and analysis if you need to view or query logs after 30 days.

• Stream activity logs to an event hub to integrate with other tools, like Azure Monitor or Splunk.
• Export activity logs for storage.
• Monitor activity in real-time with Microsoft Sentinel.

Terms of Use

Your use of the Microsoft Entra Private Access and Microsoft Entra Internet Access preview experiences and features is governed by the preview online service terms and conditions of the agreement(s) under which you obtained the services. Previews may be subject to reduced or different security, compliance, and privacy commitments, as further explained in the Universal License Terms for Online Services and the Microsoft Products and Services Data Protection Addendum (“DPA”), and any other notices provided with the Preview.

Next steps

• View network traffic logs
• Access the enriched Microsoft 365 logs