With the current design in place for the Audit logging,  we have the least amount of logging for User Management (base level), and also the option to disable this specific logging altogether.

We need more fine-grained control of this (e.g. via auditing properties) as disabling it all together won't be a suitable option.

For example, customer noticed as about 98% of their audit logs were coming from the "User management" and is caused by the Active Directory sync. They had it set to "Base" level." The health check was throwing a "Audit log Capacity" error and running the query showed they had 10 million records in the table.