Audit the admin plane itself
Admin-initiated changes are recorded as admin audit log entries
Just like tenant-facing security events are logged, actions admins take are logged too.
That creates a trail showing who changed what, and when.


Just like tenant-facing security events are logged, actions admins take are logged too.
That creates a trail showing who changed what, and when.