Audit log
An audit log is a record of system events and activities used to examine what happened, including the actions and outcomes that the system was configured to record.
A record of an action
An audit log helps answer questions such as who changed an account, which object changed, and whether the operation succeeded. What it can answer depends on the events and fields the service records.
Microsoft Entra audit logs cover changes to objects such as users, groups, and applications. Entries include activity time, service, category, and status; actor, target, and changed values are available where applicable. Sign-in logs describe a different part of the activity: attempts to authenticate and access resources.
What a successful event establishes
An account-change event marked successful can show that the recorded change completed. It does not establish who spoke to the help desk or what the account did in a business application afterwards. Those questions need the ticket and the relevant sign-in or application records.
Preserve the original event, including its timestamp and identifiers. Use an incident timeline to connect it with other evidence rather than expecting a single log to explain the whole incident.
An empty search also needs interpretation. Check collection coverage, retention, and the query before concluding that an action never happened. And recording an event does not mean someone was alerted: alerting needs its own detection logic and delivery path.