Audit Log Service  ·  View 12 of 40  ·  3 · Structure

Integration Surface

Every way in and every way out, with protocol and direction — and no interface that is both.

Editable source SVG draw.io All views
Inbound Business Applications REST, sync Platform Services Kafka protocol Azure Activity Log diagnostic settings Legal Hold Console segregated role Audit Log Service Audit Log Service one versioned schema Outbound and dependencies Azure Blob Storage immutable, ZRS Confidential Ledger separate custody Managed HSM FIPS 140-3 L3 Microsoft Entra ID workload identity mTLS · 25 k/s stream Event Hub hold API write once append sign validate Integration Surface — Every Way In and Every Way Out External / third party Queue / topic Application we own Data store Security / platform synchronous event / async There is no interface that both writes and reads. A producer credential cannot query; a query credential cannot write anything except the read record the service writes on its behalf. Spool replay after an outage re-enters through the same inbound REST contract, carrying the original occurred_at. v 1.0 · owner Data & AI Global Practice · date 2026-09

Decisions

  • No interface both writes and reads. A producer credential cannot query; a query credential writes nothing except the read record the service writes on its behalf.
  • Azure control-plane events arrive through diagnostic settings into the same schema as application events, so a subscription change and a role grant are searchable side by side.
  • Spool replay after a producer outage re-enters through the same REST contract with the original occurred_at, so a replayed event is never mistaken for a fresh one.

Interface inventory

  • Inbound: synchronous REST over mTLS (25 k/s), Kafka-protocol stream, Azure diagnostic export, legal hold API.
  • Outbound: Blob create-only, Confidential Ledger append, Managed HSM sign and wrap, Entra token validation, and an alert feed to Microsoft Sentinel that carries detections and never record content.

Omitted here

  • The external timestamp authority and the phase-3 witness log are shown on views 11, 13 and 30 where their role in the chain is legible.
◀  Custody Plane All views The Shape of the Hash Chain  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 40 views · Microsoft Azure and open source12-integration-surface