What should be preserved from cloud audit or activity records?¶

Cloud audit or activity records can show account and system events, but they must be preserved with their scope and limitations.

Avoid this assumption: The visible activity list is complete and proves who performed each action. It may be filtered, delayed, limited by permissions or based on account and device identifiers rather than personal identity.

Record the service, tenant, account, page URL, date, time, time zone and filters applied.

Capture the event type, actor account, target file or object, timestamp, device, browser, IP address, location, session ID and provider event ID where visible.

Preserve success, failure, challenge, block and administrative status.

Record the visible time range, pagination, export limit and any notice that older records are unavailable.

Do not change filters, sort order or date range before capturing the original display.

If navigation is necessary, document every filter and page change so the result can be reproduced.

Do not infer that the named actor was the human user. Shared accounts, delegated administrators, applications, scripts and compromised sessions remain possible.

Preserve any export option or provider reference without selecting it automatically.

Where the audit trail is central, request native provider records or specialist support rather than relying only on screenshots.

Distinguish investigator-created events from activity that existed before access.

Preserve any indication that audit records are delayed, sampled, incomplete or restricted by the viewer’s role, because the absence of an event may not prove it never occurred.

Operational takeaway¶

Preserve audit scope, filters, identifiers and event detail exactly as shown, while treating account activity as technical evidence that still requires attribution and completeness checks.