An enterprise security administrator needs to monitor and audit identity governance and role assignments across cloud resources. The organization requires a solution that can collect and retain audit logs showing which users were assigned access permissions, identify the administrators who performed the assignments, and provide interactive workbooks for historical analysis. Which service should the administrator configure to retain and analyze these audit log events?

Azure Monitor: ### What Azure Monitor Is **Azure Monitor** is a comprehensive cloud monitoring and observability service in Microsoft Azure that collects, analyzes, and responds to telemetry from cloud and on-premises environments. It provides deep visibility into the performance, health, and security governance of systems and applications. ### How It Meets the Auditing Requirements * **Audit Log Ingestion**: Azure Monitor can ingest audit log events from identity governance and access management systems, capturing detailed activity such as role assignments and package fulfillment. * **Tracking Actor and Target**: It retains logs detailing the specific administrator (`ActorUserPrincipalName`) who granted or revoked permissions, along with the affected user and resource scope. * **Interactive Visualization**: Administrators can leverage built-in and custom **Azure Monitor Workbooks** to create interactive reports and perform historical trend analysis on access assignments over extended retention periods. ### Key Advantages and Capabilities * **Centralized Telemetry**: Aggregates log data across subscriptions, resource groups, and tenant-level identity logs into Log Analytics workspaces. * **KQL Query Support**: Enables rich querying using Kusto Query Language (KQL) to detect unauthorized privilege elevation or anomalies. * **Custom Alerting**: Integrates with action groups to generate real-time alerts when sensitive role assignments take place. * **Compliance Retention**: Allows organizations to store audit trails beyond default operational windows to satisfy industry regulations. ### Why This Is Optimal Azure Monitor is the optimal choice because it natively centralizes and retains security and governance audit logs while offering built-in workbooks for visualization and alerting capabilities for proactive access auditing.