Audit logging for Mesh
Audit logging help organizations effectively respond to security events, forensic investigations, internal investigations, and compliance obligations. This article summarizes how to query and request audit logs for Microsoft Mesh operations and events. Some operations are Mesh specific, while others are associated with other M365 operations, such as M365: Exchange, SharePoint, Microsoft Entra (Azure AD) operations, Microsoft Teams, etc.
With audit logging for Mesh, an admin can gather insights into individual or bulk operations that relate to User Activity or operations which result from interactions with M365 services for Microsoft Mesh.
Audit logging for Mesh can be done using Microsoft Purview or Exchange Online PowerShell.
Note
Microsoft Mesh has two main offerings for users: Immersive spaces in Teams and custom immersive spaces. Audit logging does not treat these offerings as independent and thus the events in the audit may refer to either offering or both offerings, depending on the event you query.
Examples of user activity and operations that an admin may be interested in for Mesh are:
End-users in Mesh in Teams / Mesh Browser - joining Mesh sessions.
Mesh Administrators and Users creating Events on Mesh Portal.
Content Creators using Mesh Toolkit (Mesh Uploader) to create and upload artifacts.
Auditable events for Microsoft Mesh
The audit events that are currently available are listed below. Events are generated based on user activity in Mesh Admin portal, or session/template customization activity in the Mesh application.
| Event Name | Description |
|---|---|
| EnvironmentDeleted | Delete a Mesh Environment. |
| EnvironmentPublished | Publish a new version of a Mesh Environment. |
| ComponentCreated | Create a session component for a given Mesh session. |
| ComponentDeleted | Delete a session component of a given Mesh session. |
| TemplateCreated | Create a new Mesh World/Collection Template. |
| TemplateDeleted | Delete Mesh World Template contents and metadata. |
| TemplateUpdated | Update an existing Mesh World/Collection Template. |
| WorldCreated | Create a Mesh World/Collection. |
| WorldDeleted | Delete a Mesh World/Collection. |
| WorldUpdated | Update a Mesh World/Collection. |
| WorldMembersAdded | Add members to the Mesh World/Collection. |
| WorldOwnersAdded | Add owners of a Mesh World/Collection. |
| WorldMembersRemoved | Remove a member from a Mesh World/Collection. |
| WorldOwnersRemoved | Remove an owner from a Mesh World/Collection. |
| EnvironmentStorageCreated | Create a new storage location for a Mesh Environment. |
| SessionMetadataCreated | Create Mesh World/Collection Session Metadata. |
| SessionMetadataDeleted | Delete Mesh World/Collection Session Metadata. |
| SessionMetadataUpdated | Update Mesh World/Collection Session Metadata. |
| SessionMetadataTemplateCreated | Create a template customization for Mesh World/Collection. |
| SessionEnvironmentSet | Set the environment for a collaboration session. |
| SessionJoin | Mesh service provisioned the necessary system resources and provided the client application with the information required to join a Mesh session. |
Some clarification on what the terminology in these events refers to:
Session: refers to sessions when certain things are configured for environments or meetings. There are three types of sessions that are captured by audit logs:
- Template Customization Session: logs are captured when a user customizes an event template and saves changes in the Mesh application.
- Event Customization Session: logs are captured when a user customizes a single event and saves changes in the Mesh application.
- Event Session: logs are captured when a Mesh event occurs. Typically, the configuration is immutable since components cannot be placed by users in a live event, for example.
World : refers to Collections in Mesh on the web. Collections is a bucket that holds environments and templates of environments that are used in Mesh events. Audit logs capture when a user creates a Collection, deletes a Collection, adds members to a Collection, adds Owners to a Collection, or removes Owners from a collection.
Component: refers to the Objects that are rendered in an environment when a session is started for an event, template, or customization session. If a user attempts to enter an environment, the components in that environment are loaded and captured by component logs.
Microsoft Purview auditing solutions provide an integrated solution to help organizations effectively respond to security events, forensic investigations, internal investigations, and compliance obligations.
Prerequisites for Purview audit logging solutions
See how to get started with Microsoft Purview audit logging solutions.
Get started with search
See how to search the audit log in Microsoft Purview.