How are security events logged and retained?
Protected logs record relevant Device, access, synchronization, and administrative events.
Security-relevant events are recorded across applicable device-management and cloud-platform components. Records may include Device enrollment and management status, configuration and software deployment activity, Device health and connectivity, authentication and platform-access activity, synchronization events, administrative actions, and relevant creation, update, or deletion activity within the cloud platform. Logs are protected through access controls and are available only to authorized personnel according to their responsibilities.
Failed PIN entries are deliberately not logged. See Question 32 for the reasoning.