The Operations tab breaks the audit activity down by what was actually done: records created, updated, deleted or read.

Select Dashboard in the left navigation, then Operations.

The four operation types

Every chart on this tab uses the same four:

Operation Meaning Create A new record was created. Update An existing record was changed. Delete A record was deleted. Access A record was read.

Access only appears if read auditing is enabled in Dynamics 365.

Daily Operation Volume

A time series with one line per operation type.

Figure 1. The Operations tab showing the Daily Operation Volume time series with one series per CRUD operation type.

Use it to see whether today looks like a normal day. A spike in Delete is worth looking at straight away.

Activity Heatmap

Audit volume by day of week and hour of day, over the last 90 days, in UTC.

Figure 2. The Activity Heatmap showing audit volume by day and hour over the last 90 days in UTC.

Darker cells mean more activity. Because it is laid out by hour, activity outside your normal working pattern stands out immediately, which is exactly what you want when you are looking for something unusual.

Note the times are UTC, not your local time. Allow for the offset before concluding that something happened in the middle of the night.

Operation Mix

The share each operation type takes, as a ring with counts and percentages.

Figure 3. The Operation Mix ring and the Read Event Monitoring card showing privacy compliance tracking.

Most environments are dominated by Update. What matters is whether your mix stays consistent. A sudden shift usually means a bulk operation ran.

Read Event Monitoring

Read tracking for privacy compliance, relevant to GDPR and HIPAA.

Shows whether Compliance mode is active, the number of Access operations, what percentage of all activity those read events represent, and the count of Other operations.

Reads are the events that show who looked at data, as opposed to who changed it, and they are often the ones an investigation actually needs.

Operation Flow by Entity

A flow diagram connecting each operation type to the entities it affected, with Total operations and a count per operation.

Figure 4. The Operation Flow by Entity diagram showing how Create, Update, Delete and Access operations distribute across entities.

It answers a question the other charts cannot: not just how many updates happened, but which tables they happened to. Thick bands are where your audit volume is really coming from.

Note

Every card refreshes on its own, and Refresh all at the top updates the whole tab at once.