Total Administrative Transparency via Immutable Auditing

The Digital Footprint — Every Action Logged, Always

Microsoft 365 maintains a comprehensive, platform-level audit log in Microsoft Purview Audit for all administrative activity within your tenant. This is not an optional feature or a SoftSol addition — it is a core, built-in capability of the Microsoft 365 platform that cannot be disabled by any party, including SoftSol.

What this means in practice: it is technically impossible for an administrative account to perform any of the following actions without generating a permanent, timestamped, identity-attributed log entry:

Each log entry captures the exact time (UTC), the UPN of the admin account that performed the action, the target object, and the specific operation code. These records are retained for a minimum of 180 days under standard licencing and up to 10 years under Microsoft Purview Audit (Premium).

Real-Time Alerting to Your Management Team

A comprehensive audit log only provides value if the right people are notified in real time when sensitive actions occur — not after the fact during a quarterly review. We configure Microsoft Purview alert policies in your tenant to dispatch immediate notifications to your named management team members when any of the following events are triggered by any administrative account, including SoftSol’s:

• • Mailbox permission grant — any Add-MailboxPermission operation generates an immediate alert with the admin identity, target mailbox, and permission level granted.
• • eDiscovery search initiated — any new compliance search or content export triggers an alert before results are accessed, giving your team the opportunity to query the action in real time.
• • Privileged role assignment — any change to Global Admin, Exchange Admin, or other high-privilege roles in the directory triggers immediate notification to your designated security contact.
• • Mass file download or export — anomalous bulk access to SharePoint or OneDrive files from an administrative account generates an alert for your review.

Your team receives alerts via email — or optionally via webhook into your preferred notification channel — with enough detail to immediately assess the action and contact SoftSol for clarification if needed.

External Log Streaming — Tamper-Evident Third-Party Repository

Microsoft Purview’s native audit log provides a strong baseline, but it resides within the Microsoft 365 tenant itself. To provide your organisation with a completely independent and unalterable record, we configure continuous streaming of your audit logs to an external Security Information and Event Management (SIEM) repository.

This external repository is configured as read-only and append-only. Once a log event is written to it, it cannot be modified, overwritten, or deleted — by SoftSol, by your own administrators, or by any third party. The repository is physically and logically separate from your Microsoft 365 tenant and from SoftSol’s own infrastructure.

This architecture means that even in the most adversarial scenario — where SoftSol itself were somehow compromised, or where a dispute arose about what actions were or were not taken — your organisation holds a cryptographically verifiable, third-party record of the complete administrative history of your Microsoft 365 environment. It is not our word against yours. The record speaks for itself.