Audit¶

Manage SQL audit settings for Microsoft Fabric Data Warehouses and SQL Analytics Endpoints.

Targets: Data Warehouse / SQL Analytics Endpoint

CLI¶

audit add-group¶

Targets: Data Warehouse / SQL Analytics Endpoint

Add a single audit action group without overwriting the others. Idempotent - if the group is already present the command succeeds without modifying the configuration. Auditing must already be enabled.

Synopsis

fdw [-w WORKSPACE] audit add-group [WAREHOUSE] GROUP

Example

fdw -w MyWorkspace audit add-group SalesWH BATCH_COMPLETED_GROUP

audit disable¶

Targets: Data Warehouse / SQL Analytics Endpoint

Disable SQL auditing on a warehouse or SQL Analytics Endpoint.

Synopsis

fdw [-w WORKSPACE] audit disable [WAREHOUSE]

Example

fdw -w MyWorkspace audit disable SalesWH

audit enable¶

Targets: Data Warehouse / SQL Analytics Endpoint

Enable SQL auditing on a warehouse or SQL Analytics Endpoint.

Synopsis

fdw [-w WORKSPACE] audit enable [OPTIONS] [WAREHOUSE]

Option	Description	Default
`--retention-days INTEGER`	Audit log retention in days (>= 1). Mutually exclusive with `--unlimited`.	-
`--unlimited`	Set unlimited audit log retention (service value 0). Mutually exclusive with `--retention-days`.	off

Omitting both --retention-days and --unlimited defaults to unlimited retention. Passing 0 for --retention-days is rejected - use --unlimited for no-limit retention.

Example

# Retain logs for 90 days
fdw -w MyWorkspace audit enable --retention-days 90 SalesWH

# Unlimited retention
fdw -w MyWorkspace audit enable --unlimited SalesWH

audit get¶

Targets: Data Warehouse / SQL Analytics Endpoint

Get the current audit settings for a warehouse or SQL Analytics Endpoint.

Synopsis

fdw [-w WORKSPACE] audit get [WAREHOUSE]

Example

fdw -w MyWorkspace audit get SalesWH

state            Enabled
retentionDays    7
actionGroups     BATCH_COMPLETED_GROUP

audit remove-group¶

Targets: Data Warehouse / SQL Analytics Endpoint

Remove a single audit action group without overwriting the others. Idempotent - if the group is not present the command succeeds without modifying the configuration. Auditing must already be enabled.

Synopsis

fdw [-w WORKSPACE] audit remove-group [WAREHOUSE] GROUP

Example

fdw -w MyWorkspace audit remove-group SalesWH BATCH_COMPLETED_GROUP

audit set-groups¶

Targets: Data Warehouse / SQL Analytics Endpoint

Set the audit action groups for a warehouse or SQL Analytics Endpoint. Pass --group / -g once per action group. This replaces the existing list of groups.

Synopsis

fdw [-w WORKSPACE] audit set-groups -g GROUP [-g GROUP ...] [WAREHOUSE]

Option	Description
`-g` / `--group TEXT`	Audit action group name. Repeat for multiple groups. (required)

Example

fdw -w MyWorkspace audit set-groups \
  -g BATCH_COMPLETED_GROUP \
  -g SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP \
  SalesWH

audit set-retention¶

Targets: Data Warehouse / SQL Analytics Endpoint

Update the audit log retention period without changing the audit enabled/disabled state. Audit must already be enabled; if it is disabled, run audit enable first.

Synopsis

fdw [-w WORKSPACE] audit set-retention --days INTEGER [WAREHOUSE]

Option	Description
`--days INTEGER`	Retention period in days (1–3650; 3650 ≈ 10 years). (required)

Example

fdw -w MyWorkspace audit set-retention --days 90 SalesWH

MCP tools¶

add_audit_group¶

Targets: Data Warehouse / SQL Analytics Endpoint

Add a single audit action group without overwriting the others. Idempotent - if the group is already present the current settings are returned unchanged. Auditing must already be enabled.

Parameters:

workspace (str): workspace name or GUID.
warehouse (str): warehouse or SQL analytics endpoint name or GUID.
group (str): action group name (e.g. "BATCH_COMPLETED_GROUP").

Returns: AuditSettings: the updated audit settings.

disable_audit¶

Targets: Data Warehouse / SQL Analytics Endpoint

Disable SQL auditing on a warehouse or SQL analytics endpoint.

Parameters:

workspace (str): workspace name or GUID.
warehouse (str): warehouse or SQL analytics endpoint name or GUID.

Returns: AuditSettings: the updated audit settings.

enable_audit¶

Targets: Data Warehouse / SQL Analytics Endpoint

Enable SQL auditing on a warehouse or SQL analytics endpoint.

Parameters:

workspace (str): workspace name or GUID.
warehouse (str): warehouse or SQL analytics endpoint name or GUID.
retention_days (int, default 0): audit log retention in days; 0 means unlimited.

Returns: AuditSettings: the updated audit settings.

get_audit_settings¶

Targets: Data Warehouse / SQL Analytics Endpoint

Fetch the current SQL audit settings for a warehouse or SQL analytics endpoint.

Parameters:

workspace (str): workspace name or GUID.
warehouse (str): warehouse or SQL analytics endpoint name or GUID.

Returns: AuditSettings: object with state (Enabled or Disabled), retentionDays, and auditActionsAndGroups.

remove_audit_group¶

Targets: Data Warehouse / SQL Analytics Endpoint

Remove a single audit action group without overwriting the others. Idempotent - if the group is not present the current settings are returned unchanged. Auditing must already be enabled.

Parameters:

workspace (str): workspace name or GUID.
warehouse (str): warehouse or SQL analytics endpoint name or GUID.
group (str): action group name (e.g. "BATCH_COMPLETED_GROUP").

Returns: AuditSettings: the updated audit settings.

set_audit_action_groups¶

Targets: Data Warehouse / SQL Analytics Endpoint

Replace the audited action groups for a warehouse or SQL analytics endpoint. This overwrites the existing list of groups.

Parameters:

workspace (str): workspace name or GUID.
warehouse (str): warehouse or SQL analytics endpoint name or GUID.
action_groups (list[str]): list of audit action group names (e.g. ["BATCH_COMPLETED_GROUP"]).

Returns: AuditSettings: the updated audit settings.

set_audit_retention¶

Targets: Data Warehouse / SQL Analytics Endpoint

Update the audit log retention period without changing the audit enabled/disabled state. Audit must already be enabled; if it is disabled, enable it first with enable_audit.

Parameters:

workspace (str): workspace name or GUID.
warehouse (str): warehouse or SQL analytics endpoint name or GUID.
days (int): retention period in days (1–3650; 3650 ≈ 10 years).

Returns: AuditSettings: the updated audit settings.