Question

You manage an Azure SQL Database that stores regulated healthcare data. Compliance auditors require that all successful and failed login attempts, plus schema changes, be captured and retained for at least two years in a queryable store that supports Kusto (KQL) analysis and long-term archival without managing your own storage lifecycle policies. Which auditing configuration best meets these requirements?

Accepted Answer

Enable Azure SQL Database auditing and send audit logs to a Log Analytics workspace, configuring the workspace data retention to 730 days.

Answer

Enable server-level auditing writing to an Azure Storage account and set the retention slider on the storage destination to 730 days.

Answer

Enable auditing to Event Hubs and rely on the consumer application to archive events for two years.

Answer

Use Extended Events sessions saved to a local database table and export the data monthly to a CSV file.