Data Retention Changes
Query
//This query produces results that show when data retention on a LAW was changed and who did it
union Operation
| where OperationStatus == "Succeeded"
| where OperationCategory == "Workspace Configuration"
| project TimeGenerated, DetailExplanation
This query combines data from the "Operation" table to show when and by whom the data retention on a LAW (presumably a system or application) was changed. It filters for successful operations related to workspace configuration and projects the time and details of the changes.
Details
Rod Trent
Released: July 7, 2021
Tables
Operation
Keywords
DataRetentionLAWChangedWho
Operators
unionwhereproject