Query Details
Data Retention Changes
Query
//This query produces results that show when data retention on a LAW was changed and who did it union Operation | where OperationStatus == "Succeeded" | where OperationCategory == "Workspace Configuration" | project TimeGenerated, Detail
Explanation
This query combines data from the "Operation" table to show when and by whom the data retention on a LAW (presumably a system or application) was changed. It filters for successful operations related to workspace configuration and projects the time and details of the changes.
Details
Rod Trent
Released: July 7, 2021
Tables
Operation
Keywords
DataRetention,LAW,Changed,Who
Operators
unionwhereproject