The Azure AD audit logs are the definitive source for tracking administrative and policy-related events within a tenant. When a user is presented with a Terms of Use (ToU) policy and either accepts or declines it, a specific audit event is generated. These logs capture the user's identity, the timestamp of the action, and the outcome (accept or decline). By filtering the audit logs for the "UserManagement" category and activities related to "Accept terms of use policy" or "Decline terms of use policy," an administrator can accurately identify the status for each user regarding "Terms1".

A. provisioning logs: These logs track the creation, update, and deletion of users and groups, typically related to automated provisioning, not user consent actions.

B. the Usage and Insights report: This provides aggregated data and trends on application usage and sign-in activity, not granular, event-level details of ToU acceptance.

C. sign-in logs: These logs record user authentication events. While a ToU may be part of the sign-in flow, the log's primary focus is on the sign-in itself, not the specific consent action.

1. Microsoft Learn | Azure Active Directory documentation. "Monitor and report on terms of use." This document explicitly states

"The Azure AD audit logs record user activity

including consent to a terms of use policy... To view who has and has not accepted a ToU policy

in Azure Active Directory

select Terms of use. Select a terms of use policy. Under Monitor

select Accepted." The underlying data for this view is sourced from the audit logs. The document further details filtering the audit log for the "Accept terms of use policy" activity.

2. Microsoft Learn | Azure Active Directory documentation. "Audit log activities." This reference lists all activities recorded in the audit logs. Under the "User management" category

it includes "Accept terms of use policy" and "Decline terms of use policy" as specific

logged events.

3. Microsoft Learn | Azure Active Directory documentation. "What are Azure Active Directory reports?" This document describes the different types of reports. It clarifies that audit logs capture "a record of all events that occur in your tenant

" while sign-in logs capture "information about the usage of managed applications and user sign-in activities

" confirming the distinct purpose of each log.