diff --git a/.github/workflows/ci-ui-tests.yaml b/.github/workflows/ci-ui-tests.yaml
index 9371c0954..ab8e6d68b 100644
--- a/.github/workflows/ci-ui-tests.yaml
+++ b/.github/workflows/ci-ui-tests.yaml
@@ -43,6 +43,8 @@ jobs:
           EXCEPTIONS_API_URL: ${{ vars.EXCEPTIONS_API_URL }}
           COHORT_MANAGER_RBAC_CODE: ${{ vars.COHORT_MANAGER_RBAC_CODE }}
           NEXTAUTH_SECRET: ${{ secrets.NEXTAUTH_SECRET }}
+          COHORT_MANAGER_REMOVE_DUMMY_GP_CODE_RBAC_CODE: ${{ vars.COHORT_MANAGER_REMOVE_DUMMY_GP_CODE_RBAC_CODE }}
+          REMOVE_DUMMY_GP_CODE_API_URL: ${{ vars.REMOVE_DUMMY_GP_CODE_API_URL }}
         run: npm run test:e2e
 
       - name: Upload test results
diff --git a/application/CohortManager/src/Functions/AuditServices/AuditWriter/AuditWriter.cs b/application/CohortManager/src/Functions/AuditServices/AuditWriter/AuditWriter.cs
index b0a2a2f75..52694cb52 100644
--- a/application/CohortManager/src/Functions/AuditServices/AuditWriter/AuditWriter.cs
+++ b/application/CohortManager/src/Functions/AuditServices/AuditWriter/AuditWriter.cs
@@ -1,24 +1,36 @@
 namespace NHS.CohortManager.AuditServices;
 
 using System.Text.Json;
+using Common;
 using DataServices.Database;
 using Microsoft.Azure.Functions.Worker;
 using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
 using Model;
 
 public class AuditWriter
 {
+    private const string AuditBlobContainer = "participant-audit";
+
     private static readonly JsonSerializerOptions JsonOptions = new()
     {
         PropertyNameCaseInsensitive = true
     };
 
     private readonly DataServicesContext _dbContext;
+    private readonly IBlobStorageHelper _blobStorageHelper;
+    private readonly AuditConfig _config;
     private readonly ILogger<AuditWriter> _logger;
 
-    public AuditWriter(DataServicesContext dbContext, ILogger<AuditWriter> logger)
+    public AuditWriter(
+        DataServicesContext dbContext,
+        IBlobStorageHelper blobStorageHelper,
+        IOptions<AuditConfig> config,
+        ILogger<AuditWriter> logger)
     {
         _dbContext = dbContext;
+        _blobStorageHelper = blobStorageHelper;
+        _config = config.Value;
         _logger = logger;
     }
 
@@ -43,6 +55,8 @@ public async Task Run(
             return;
         }
 
+        var rawDataRef = await WriteSnapshotToBlobAsync(audit);
+
         var auditLog = new ParticipantAuditLog
         {
             CorrelationId = audit.CorrelationId,
@@ -53,7 +67,7 @@ public async Task Run(
             RecordSourceDesc = audit.RecordSourceDesc,
             CreatedBy = audit.CreatedBy,
             ScreeningId = audit.ScreeningId,
-            RawDataRef = audit.RawDataRef
+            RawDataRef = rawDataRef
         };
 
         try
@@ -80,4 +94,44 @@ public async Task Run(
                 audit.CorrelationId);
         }
     }
+
+    private async Task<string?> WriteSnapshotToBlobAsync(ParticipantAuditMessage message)
+    {
+        if (message.RequestSnapshot is null)
+        {
+            return null;
+        }
+
+        var blobPath = $"{message.CreatedDatetime:dd-MM-yyyy}/{message.CorrelationId}.json";
+        var payload = JsonSerializer.SerializeToUtf8Bytes(message.RequestSnapshot, JsonOptions);
+        var blobFile = new BlobFile(payload, blobPath);
+
+        try
+        {
+            var uri = await _blobStorageHelper.UploadFileToBlobStorageAndGetUri(
+                _config.AzureWebJobsStorage,
+                AuditBlobContainer,
+                blobFile,
+                overwrite: true);
+
+            if (uri is null)
+            {
+                _logger.LogError(
+                    "Blob write returned null URI for CorrelationId {CorrelationId}.",
+                    message.CorrelationId);
+                throw new InvalidOperationException(
+                    $"Blob write returned null URI for CorrelationId {message.CorrelationId}.");
+            }
+
+            return uri;
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(
+                ex,
+                "Failed to write audit snapshot to blob for CorrelationId {CorrelationId}.",
+                message.CorrelationId);
+            throw;
+        }
+    }
 }
diff --git a/application/CohortManager/src/Functions/AuditServices/AuditWriter/Program.cs b/application/CohortManager/src/Functions/AuditServices/AuditWriter/Program.cs
index 08e5fb668..d73f50f59 100644
--- a/application/CohortManager/src/Functions/AuditServices/AuditWriter/Program.cs
+++ b/application/CohortManager/src/Functions/AuditServices/AuditWriter/Program.cs
@@ -13,6 +13,7 @@
     .AddServiceBusClient(auditConfig.ServiceBusConnectionString)
     .ConfigureServices(services =>
     {
+        services.AddTransient<IBlobStorageHelper, BlobStorageHelper>();
         services.AddDatabaseHealthCheck("AuditWriter");
     })
     .AddTelemetry()
diff --git a/application/CohortManager/src/Functions/CaasIntegration/receiveCaasFile/Program.cs b/application/CohortManager/src/Functions/CaasIntegration/receiveCaasFile/Program.cs
index 1eac0759d..5f4ad9360 100644
--- a/application/CohortManager/src/Functions/CaasIntegration/receiveCaasFile/Program.cs
+++ b/application/CohortManager/src/Functions/CaasIntegration/receiveCaasFile/Program.cs
@@ -37,13 +37,12 @@
         services.AddTransient<IBlobStorageHelper, BlobStorageHelper>();
         services.AddTransient<ICopyFailedBatchToBlob, CopyFailedBatchToBlob>();
         services.AddScoped<IValidateDates, ValidateDates>();
-        services.AddTransient<IAuditLogClient, AuditLogClient>();
         // Register health checks
         services.AddBlobStorageHealthCheck("receiveCaasFile");
     })
     .AddTelemetry()
     .AddHttpClient()
-    .AddServiceBusClient(config.ServiceBusConnectionString_client_internal)
+    .AddAuditLogging(config.ServiceBusConnectionString_client_internal)
     .AddExceptionHandler()
     .AddDatabaseConnection()
     .Build();
diff --git a/application/CohortManager/src/Functions/ParticipantManagementServices/ManageServiceNowParticipant/ManageServiceNowParticipantFunction.cs b/application/CohortManager/src/Functions/ParticipantManagementServices/ManageServiceNowParticipant/ManageServiceNowParticipantFunction.cs
index b85d71087..abbf3e067 100644
--- a/application/CohortManager/src/Functions/ParticipantManagementServices/ManageServiceNowParticipant/ManageServiceNowParticipantFunction.cs
+++ b/application/CohortManager/src/Functions/ParticipantManagementServices/ManageServiceNowParticipant/ManageServiceNowParticipantFunction.cs
@@ -23,13 +23,12 @@ public class ManageServiceNowParticipantFunction
     private readonly IExceptionHandler _exceptionHandler;
     private readonly IDataServiceClient<ParticipantManagement> _participantManagementClient;
     private readonly IQueueClient _queueClient;
-    private readonly IAuditLogClient _auditLogClient;
 
     private static readonly Regex NonLetterRegex = new(@"[^\p{Lu}\p{Ll}\p{Lt}]", RegexOptions.Compiled, TimeSpan.FromSeconds(1));
 
     public ManageServiceNowParticipantFunction(ILogger<ManageServiceNowParticipantFunction> logger, IOptions<ManageServiceNowParticipantConfig> config,
         IHttpClientFunction httpClientFunction, IExceptionHandler handleException, IDataServiceClient<ParticipantManagement> participantManagementClient,
-        IQueueClient queueClient, IAuditLogClient auditLogClient)
+        IQueueClient queueClient)
     {
         _logger = logger;
         _config = config.Value;
@@ -37,7 +36,6 @@ public ManageServiceNowParticipantFunction(ILogger<ManageServiceNowParticipantFu
         _exceptionHandler = handleException;
         _participantManagementClient = participantManagementClient;
         _queueClient = queueClient;
-        _auditLogClient = auditLogClient;
     }
 
     /// <summary>
@@ -86,15 +84,6 @@ public async Task Run([ServiceBusTrigger(topicName: "%ServiceNowParticipantManag
                 await HandleException(new Exception($"Failed to send participant from ServiceNow to topic: {_config.CohortDistributionTopic}"), serviceNowParticipant, ServiceNowMessageType.AddRequestInProgress);
             }
 
-            await _auditLogClient.AddAsync(new ParticipantAuditMessage
-            {
-                NhsNumber = serviceNowParticipant.NhsNumber.ToString(),
-                Source = AuditSource.ManualAdd,
-                RecordSourceDesc = $"ServiceNow case: {serviceNowParticipant.ServiceNowCaseNumber}",
-                CreatedBy = nameof(ManageServiceNowParticipantFunction),
-                ScreeningId = (int)serviceNowParticipant.ScreeningId,
-                RequestSnapshot = serviceNowParticipant,
-            });
         }
         catch (Exception ex)
         {
diff --git a/application/CohortManager/src/Functions/ParticipantManagementServices/ManageServiceNowParticipant/Program.cs b/application/CohortManager/src/Functions/ParticipantManagementServices/ManageServiceNowParticipant/Program.cs
index adf6e486e..b546f796b 100644
--- a/application/CohortManager/src/Functions/ParticipantManagementServices/ManageServiceNowParticipant/Program.cs
+++ b/application/CohortManager/src/Functions/ParticipantManagementServices/ManageServiceNowParticipant/Program.cs
@@ -8,8 +8,7 @@
 
 var host = new HostBuilder()
     .AddConfiguration(out ManageServiceNowParticipantConfig config)
-    .AddConfiguration<AuditClientConfig>()
-        .AddDataServicesHandler()
+    .AddDataServicesHandler()
         .AddDataService<ParticipantManagement>(config.ParticipantManagementURL)
         .Build()
     .ConfigureFunctionsWorkerDefaults()
@@ -18,11 +17,10 @@
         // Register health checks
         services.AddBasicHealthCheck("ManageServiceNowParticipant");
         services.AddTransient<IBlobStorageHelper, BlobStorageHelper>();
-        services.AddTransient<IAuditLogClient, AuditLogClient>();
     })
+    .AddServiceBusClient(config.ServiceBusConnectionString_client_internal)
     .AddTelemetry()
     .AddExceptionHandler()
-    .AddServiceBusClient(config.ServiceBusConnectionString_client_internal)
     .AddHttpClient()
     .Build();
 
diff --git a/application/CohortManager/src/Functions/ParticipantManagementServices/RemoveDummyGPCode/Program.cs b/application/CohortManager/src/Functions/ParticipantManagementServices/RemoveDummyGPCode/Program.cs
index 299fed870..0471fc3f7 100644
--- a/application/CohortManager/src/Functions/ParticipantManagementServices/RemoveDummyGPCode/Program.cs
+++ b/application/CohortManager/src/Functions/ParticipantManagementServices/RemoveDummyGPCode/Program.cs
@@ -6,12 +6,13 @@
 
 var host = new HostBuilder()
     .AddConfiguration(out RemoveDummyGpCodeConfig config)
-    .ConfigureFunctionsWorkerDefaults()
+    .AddAuthentication()
     .ConfigureServices(services =>
     {
         services.AddSingleton<ICreateResponse, CreateResponse>();
         services.AddBasicHealthCheck("RemoveDummyGPCode");
     })
+    .AddAuditLogging(config.ServiceBusConnectionString_client_internal)
     .AddTelemetry()
     .AddHttpClient()
     .AddServiceBusClient(config.ServiceBusConnectionString_client_internal)
diff --git a/application/CohortManager/src/Functions/ParticipantManagementServices/RemoveDummyGPCode/ReceiveRemoveDummyGPCodeFunction.cs b/application/CohortManager/src/Functions/ParticipantManagementServices/RemoveDummyGPCode/ReceiveRemoveDummyGPCodeFunction.cs
index 29ef5ee6e..3a5174f83 100644
--- a/application/CohortManager/src/Functions/ParticipantManagementServices/RemoveDummyGPCode/ReceiveRemoveDummyGPCodeFunction.cs
+++ b/application/CohortManager/src/Functions/ParticipantManagementServices/RemoveDummyGPCode/ReceiveRemoveDummyGPCodeFunction.cs
@@ -14,6 +14,7 @@ namespace NHS.CohortManager.ParticipantManagementServices;
 using Microsoft.Extensions.Options;
 using Model;
 using Model.Constants;
+using Model.Enums;
 using NHS.CohortManager.ParticipantManagementServices.Models;
 
 public class ReceiveRemoveDummyGpCodeFunction
@@ -23,6 +24,8 @@ public class ReceiveRemoveDummyGpCodeFunction
     private readonly IHttpClientFunction _httpClientFunction;
     private readonly IQueueClient _queueClient;
     private readonly RemoveDummyGpCodeConfig _config;
+    private readonly IAuditLogClient _auditLogClient;
+    private readonly IFunctionContextAuthResolver _authResolver;
 
     private static readonly Regex NonLetterRegex = new(@"[^\p{Lu}\p{Ll}\p{Lt}]", RegexOptions.Compiled, TimeSpan.FromSeconds(1));
 
@@ -31,19 +34,24 @@ public ReceiveRemoveDummyGpCodeFunction(
         ICreateResponse createResponse,
         IHttpClientFunction httpClientFunction,
         IQueueClient queueClient,
-        IOptions<RemoveDummyGpCodeConfig> config)
+        IOptions<RemoveDummyGpCodeConfig> config,
+        IAuditLogClient auditLogClient,
+        IFunctionContextAuthResolver authResolver)
     {
         _logger = logger;
         _createResponse = createResponse;
         _httpClientFunction = httpClientFunction;
         _queueClient = queueClient;
         _config = config.Value;
+        _auditLogClient = auditLogClient;
+        _authResolver = authResolver;
     }
 
     /// <summary>
     /// Validates and enqueues a dummy GP code removal request to the ServiceNow participant management topic.
     /// </summary>
     [Function("ReceiveRemoveDummyGPCodeFunction")]
+    [Authentication(Role.CohortManagerDummyGpRemoval)]
     public async Task<HttpResponseData> Run([HttpTrigger(AuthorizationLevel.Anonymous, "post", Route = "RemoveDummyGPCode")] HttpRequestData req)
     {
         try
@@ -55,6 +63,29 @@ public async Task<HttpResponseData> Run([HttpTrigger(AuthorizationLevel.Anonymou
                 return _createResponse.CreateHttpResponse(HttpStatusCode.BadRequest, req);
             }
 
+
+            var user = _authResolver.GetCis2User(req.FunctionContext);
+
+            if (user == null && _authResolver.IsAuthenticationRequired(req.FunctionContext))
+            {
+                _logger.LogWarning("Authentication is required but user information could not be retrieved from the function context");
+                return _createResponse.CreateHttpResponse(HttpStatusCode.Unauthorized, req);
+            }
+
+
+            await _auditLogClient.AddAsync(new ParticipantAuditMessage
+            {
+                NhsNumber = requestBody.NhsNumber,
+                Source = AuditSource.DummyGpRemoval,
+                RecordSourceDesc = "Dummy GP Code Removal Form",
+                CreatedBy = user != null ? user.Uid : "Unknown User",
+                ScreeningId = (int)ServiceProvider.BSS,
+                RequestSnapshot = requestBody
+
+            });
+
+
+
             var validationContext = new ValidationContext(requestBody);
             var validationResult = new List<ValidationResult>();
             var isRequestValid = Validator.TryValidateObject(requestBody, validationContext, validationResult, true);
diff --git a/application/CohortManager/src/Functions/ServiceNowIntegration/ServiceNowMessageHandler/Program.cs b/application/CohortManager/src/Functions/ServiceNowIntegration/ServiceNowMessageHandler/Program.cs
index 78f9c2611..b6b415551 100644
--- a/application/CohortManager/src/Functions/ServiceNowIntegration/ServiceNowMessageHandler/Program.cs
+++ b/application/CohortManager/src/Functions/ServiceNowIntegration/ServiceNowMessageHandler/Program.cs
@@ -22,6 +22,7 @@
         // Register health checks
         services.AddBasicHealthCheck("ServiceNowMessageHandler");
     })
+    .AddAuditLogging(config.ServiceBusConnectionString_client_internal)
     .AddTelemetry()
     .AddServiceBusClient(config.ServiceBusConnectionString_client_internal)
     .Build();
diff --git a/application/CohortManager/src/Functions/ServiceNowIntegration/ServiceNowMessageHandler/ReceiveServiceNowMessageFunction.cs b/application/CohortManager/src/Functions/ServiceNowIntegration/ServiceNowMessageHandler/ReceiveServiceNowMessageFunction.cs
index f7c0cd54a..437b92c07 100644
--- a/application/CohortManager/src/Functions/ServiceNowIntegration/ServiceNowMessageHandler/ReceiveServiceNowMessageFunction.cs
+++ b/application/CohortManager/src/Functions/ServiceNowIntegration/ServiceNowMessageHandler/ReceiveServiceNowMessageFunction.cs
@@ -22,15 +22,17 @@ public class ReceiveServiceNowMessageFunction
     private readonly ServiceNowMessageHandlerConfig _config;
     private readonly IDataServiceClient<ServicenowCase> _serviceNowCaseClient;
     private readonly IServiceNowClient _serviceNowClient;
+    private readonly IAuditLogClient _auditLogClient;
 
     public ReceiveServiceNowMessageFunction(ILogger<ReceiveServiceNowMessageFunction> logger, ICreateResponse createResponse,
         IQueueClient queueClient, IOptions<ServiceNowMessageHandlerConfig> config, IDataServiceClient<ServicenowCase> serviceNowCaseClient,
-        IServiceNowClient serviceNowClient)
+        IServiceNowClient serviceNowClient, IAuditLogClient auditLogClient)
     {
         _logger = logger;
         _createResponse = createResponse;
         _queueClient = queueClient;
         _config = config.Value;
+        _auditLogClient = auditLogClient;
         _serviceNowCaseClient = serviceNowCaseClient;
         _serviceNowClient = serviceNowClient;
     }
@@ -59,6 +61,16 @@ public async Task<HttpResponseData> Run([HttpTrigger(AuthorizationLevel.Anonymou
                 return _createResponse.CreateHttpResponse(HttpStatusCode.BadRequest, req);
             }
 
+            await _auditLogClient.AddAsync(new ParticipantAuditMessage
+            {
+                NhsNumber = requestBody.VariableData.NhsNumber,
+                Source = AuditSource.ManualAdd,
+                RecordSourceDesc = $"ServiceNow case: {requestBody.ServiceNowCaseNumber}",
+                CreatedBy = nameof(ReceiveServiceNowMessageFunction),
+                ScreeningId = (int)ServiceProvider.BSS,
+                RequestSnapshot = requestBody
+            });
+
             var validationContext = new ValidationContext(requestBody.VariableData);
             var validationResult = new List<ValidationResult>();
             bool isVariableDataValid = Validator.TryValidateObject(requestBody.VariableData, validationContext, validationResult, true);
diff --git a/application/CohortManager/src/Functions/Shared/Common/AuditLogClient.cs b/application/CohortManager/src/Functions/Shared/Common/AuditLogClient.cs
index 04367c298..6b43f084a 100644
--- a/application/CohortManager/src/Functions/Shared/Common/AuditLogClient.cs
+++ b/application/CohortManager/src/Functions/Shared/Common/AuditLogClient.cs
@@ -1,32 +1,22 @@
 namespace Common;
 
-using System.Text.Json;
+using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
 using Model;
 
 public class AuditLogClient : IAuditLogClient
 {
-    private const string AuditBlobContainer = "participant-audit";
-
-    private static readonly JsonSerializerOptions JsonOptions = new()
-    {
-        PropertyNameCaseInsensitive = true
-    };
-
     private readonly IQueueClient _queueClient;
-    private readonly IBlobStorageHelper _blobStorageHelper;
     private readonly AuditClientConfig _config;
     private readonly ILogger<AuditLogClient> _logger;
 
     public AuditLogClient(
-        IQueueClient queueClient,
-        IBlobStorageHelper blobStorageHelper,
+        [FromKeyedServices("AuditWriter")] IQueueClient queueClient,
         IOptions<AuditClientConfig> config,
         ILogger<AuditLogClient> logger)
     {
         _queueClient = queueClient;
-        _blobStorageHelper = blobStorageHelper;
         _config = config.Value;
         _logger = logger;
     }
@@ -35,8 +25,6 @@ public async Task AddAsync(ParticipantAuditMessage message)
     {
         ArgumentNullException.ThrowIfNull(message);
 
-        message.RawDataRef = await WriteSnapshotToBlobAsync(message);
-
         var sent = await _queueClient.AddAsync(message, _config.AuditTopicName);
         if (!sent)
         {
@@ -56,47 +44,6 @@ public async Task<int> AddBatchAsync(IEnumerable<ParticipantAuditMessage> messag
         ArgumentNullException.ThrowIfNull(messages);
 
         var messageList = messages.ToList();
-        foreach (var message in messageList)
-        {
-            message.RawDataRef = await WriteSnapshotToBlobAsync(message);
-        }
-
         return await _queueClient.AddBatchAsync(messageList, _config.AuditTopicName);
     }
-
-    private async Task<string?> WriteSnapshotToBlobAsync(ParticipantAuditMessage message)
-    {
-        if (message.RequestSnapshot is null)
-        {
-            return null;
-        }
-
-        try
-        {
-            var blobPath = $"{message.CreatedDatetime:dd-MM-yyyy}/{message.CorrelationId}.json";
-            var payload = JsonSerializer.SerializeToUtf8Bytes(message.RequestSnapshot, JsonOptions);
-
-            var blobFile = new BlobFile(payload, blobPath);
-            var uri = await _blobStorageHelper.UploadFileToBlobStorageAndGetUri(
-                _config.AzureWebJobsStorage, AuditBlobContainer, blobFile, overwrite: true);
-
-            if (uri is null)
-            {
-                _logger.LogError(
-                    "Blob write returned null URI for CorrelationId {CorrelationId}. " +
-                    "Audit will be persisted without a blob reference.",
-                    message.CorrelationId);
-            }
-
-            return uri;
-        }
-        catch (Exception ex)
-        {
-            _logger.LogError(ex,
-                "Failed to write audit snapshot to blob for CorrelationId {CorrelationId}. " +
-                "Audit will be persisted without a blob reference.",
-                message.CorrelationId);
-            return null;
-        }
-    }
 }
diff --git a/application/CohortManager/src/Functions/Shared/Common/Extensions/FunctionContextExtension.cs b/application/CohortManager/src/Functions/Shared/Common/Authentication/FunctionContextAuthResolver.cs
similarity index 59%
rename from application/CohortManager/src/Functions/Shared/Common/Extensions/FunctionContextExtension.cs
rename to application/CohortManager/src/Functions/Shared/Common/Authentication/FunctionContextAuthResolver.cs
index d7bb1e971..6989211b2 100644
--- a/application/CohortManager/src/Functions/Shared/Common/Extensions/FunctionContextExtension.cs
+++ b/application/CohortManager/src/Functions/Shared/Common/Authentication/FunctionContextAuthResolver.cs
@@ -4,29 +4,44 @@ namespace Common;
 using System.Reflection;
 using Microsoft.Azure.Functions.Worker;
 
-public static class FunctionContextExtension
+public class FunctionContextAuthResolver : IFunctionContextAuthResolver
 {
-    public static bool RequiresAuthentication(this FunctionContext context)
+    private static readonly ConcurrentDictionary<string, FunctionEndpoint?> FunctionEndpointCache = new();
+
+    public FunctionContextAuthResolver()
+    {
+    }
+
+    public Cis2User? GetCis2User(FunctionContext context)
+    {
+        ArgumentNullException.ThrowIfNull(context);
+
+        return context.Items.TryGetValue("Cis2User", out var user) ? user as Cis2User : null;
+    }
+
+    public bool IsAuthenticationRequired(FunctionContext context)
     {
-        var authAttribute = context.GetEndpoint()?.Metadata.GetMetadata<AuthenticationAttribute>();
+        ArgumentNullException.ThrowIfNull(context);
+
+        var authAttribute = GetEndpoint(context)?.Metadata.GetMetadata<AuthenticationAttribute>();
         return authAttribute != null;
     }
 
-    public static Role[] GetRequiredRoles(this FunctionContext context)
+    public Role[] GetRequiredRoles(FunctionContext context)
     {
-        var authAttribute = context.GetEndpoint()?.Metadata.GetMetadata<AuthenticationAttribute>();
+        ArgumentNullException.ThrowIfNull(context);
+
+        var authAttribute = GetEndpoint(context)?.Metadata.GetMetadata<AuthenticationAttribute>();
         return authAttribute?.Roles ?? Array.Empty<Role>();
     }
 
-    public static FunctionEndpoint? GetEndpoint(this FunctionContext context)
+    private static FunctionEndpoint? GetEndpoint(FunctionContext context)
     {
         ArgumentNullException.ThrowIfNull(context);
 
         return FunctionEndpointCache.GetOrAdd(context.FunctionDefinition.EntryPoint, CreateEndpoint);
     }
 
-    private static readonly ConcurrentDictionary<string, FunctionEndpoint?> FunctionEndpointCache = new();
-
     private static FunctionEndpoint? CreateEndpoint(string entryPoint)
     {
         if (string.IsNullOrWhiteSpace(entryPoint))
@@ -57,28 +72,3 @@ public static Role[] GetRequiredRoles(this FunctionContext context)
             : new FunctionEndpoint(method.GetCustomAttributes(inherit: true));
     }
 }
-
-public sealed class FunctionEndpoint
-{
-    public FunctionEndpoint(IEnumerable<object> metadata)
-    {
-        Metadata = new FunctionEndpointMetadataCollection(metadata);
-    }
-
-    public FunctionEndpointMetadataCollection Metadata { get; }
-}
-
-public sealed class FunctionEndpointMetadataCollection
-{
-    private readonly IReadOnlyList<object> _metadata;
-
-    public FunctionEndpointMetadataCollection(IEnumerable<object> metadata)
-    {
-        _metadata = metadata.ToArray();
-    }
-
-    public T? GetMetadata<T>() where T : class
-    {
-        return _metadata.OfType<T>().FirstOrDefault();
-    }
-}
diff --git a/application/CohortManager/src/Functions/Shared/Common/Authentication/IFunctionContextAuthResolver.cs b/application/CohortManager/src/Functions/Shared/Common/Authentication/IFunctionContextAuthResolver.cs
new file mode 100644
index 000000000..3b60836e5
--- /dev/null
+++ b/application/CohortManager/src/Functions/Shared/Common/Authentication/IFunctionContextAuthResolver.cs
@@ -0,0 +1,12 @@
+namespace Common;
+
+using Microsoft.Azure.Functions.Worker;
+
+public interface IFunctionContextAuthResolver
+{
+    Cis2User? GetCis2User(FunctionContext context);
+
+    bool IsAuthenticationRequired(FunctionContext context);
+
+    Role[] GetRequiredRoles(FunctionContext context);
+}
diff --git a/application/CohortManager/src/Functions/Shared/Common/Authentication/Middleware/Cis2AuthMiddleware.cs b/application/CohortManager/src/Functions/Shared/Common/Authentication/Middleware/Cis2AuthMiddleware.cs
index f605e5780..1cd7e1d67 100644
--- a/application/CohortManager/src/Functions/Shared/Common/Authentication/Middleware/Cis2AuthMiddleware.cs
+++ b/application/CohortManager/src/Functions/Shared/Common/Authentication/Middleware/Cis2AuthMiddleware.cs
@@ -4,6 +4,7 @@ namespace Common;
 using Microsoft.Azure.Functions.Worker;
 using Microsoft.Azure.Functions.Worker.Http;
 using Microsoft.Azure.Functions.Worker.Middleware;
+using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
 
@@ -13,27 +14,29 @@ public class Cis2AuthMiddleware : IFunctionsWorkerMiddleware
     private readonly ILogger<Cis2AuthMiddleware> _logger;
     private readonly ICreateResponse _createResponse;
     private readonly IAuthenticationService _authService;
-    private readonly ICis2UserService _cis2UserService;
     private readonly AuthConfig _authConfig;
+    private readonly IFunctionContextAuthResolver _authResolver;
 
-    public Cis2AuthMiddleware(ILogger<Cis2AuthMiddleware> logger, ICreateResponse createResponse, IAuthenticationService authService, ICis2UserService cis2UserService, IOptions<AuthConfig> authConfig)
+    public Cis2AuthMiddleware(ILogger<Cis2AuthMiddleware> logger , ICreateResponse createResponse, IAuthenticationService authService, IOptions<AuthConfig> authConfig, IFunctionContextAuthResolver authResolver)
     {
         _logger = logger;
         _createResponse = createResponse;
         _authService = authService;
-        _cis2UserService = cis2UserService;
         _authConfig = authConfig.Value;
+        _authResolver = authResolver;
     }
 
     public async Task Invoke(FunctionContext context, FunctionExecutionDelegate next)
     {
-        if(_authConfig.ByPassAuthentication || !context.RequiresAuthentication())
+        if(_authConfig.ByPassAuthentication || !_authResolver.IsAuthenticationRequired(context))
         {
             _logger.LogInformation("Authentication is bypassed or not required for this endpoint, skipping authentication.");
             await next(context);
             return;
         }
 
+        var cis2UserService = context.InstanceServices.GetRequiredService<ICis2UserService>();
+
         var req = await context.GetHttpRequestDataAsync();
 
         if(req == null)
@@ -59,7 +62,7 @@ public async Task Invoke(FunctionContext context, FunctionExecutionDelegate next
             return;
         }
 
-        var cis2User = await _cis2UserService.GetUserFromToken(accessToken);
+        var cis2User = await cis2UserService.GetUserFromToken(accessToken);
         if(cis2User == null)
         {
             await HandleUnauthorizedAsync(context, req!, "Failed to retrieve user from token", "Unauthorized: Failed to retrieve user from token.");
diff --git a/application/CohortManager/src/Functions/Shared/Common/Authentication/Middleware/PermissionsMiddleware.cs b/application/CohortManager/src/Functions/Shared/Common/Authentication/Middleware/PermissionsMiddleware.cs
index 7ff3b2528..a2bbad9cd 100644
--- a/application/CohortManager/src/Functions/Shared/Common/Authentication/Middleware/PermissionsMiddleware.cs
+++ b/application/CohortManager/src/Functions/Shared/Common/Authentication/Middleware/PermissionsMiddleware.cs
@@ -12,13 +12,15 @@ public class PermissionsMiddleware : IFunctionsWorkerMiddleware
     private readonly IRoleManager _roleManager;
     private readonly ILogger<PermissionsMiddleware> _logger;
     private readonly AuthConfig _authConfig;
+    private readonly IFunctionContextAuthResolver _authResolver;
 
-    public PermissionsMiddleware(ICreateResponse createResponse, IRoleManager roleManager, ILogger<PermissionsMiddleware> logger, IOptions<AuthConfig> authConfig)
+    public PermissionsMiddleware(ICreateResponse createResponse, IRoleManager roleManager, ILogger<PermissionsMiddleware> logger, IOptions<AuthConfig> authConfig, IFunctionContextAuthResolver authResolver)
     {
         _createResponse = createResponse;
         _roleManager = roleManager;
         _logger = logger;
         _authConfig = authConfig.Value;
+        _authResolver = authResolver;
      }
 
     public async Task Invoke(FunctionContext context, FunctionExecutionDelegate next)
@@ -30,13 +32,13 @@ public async Task Invoke(FunctionContext context, FunctionExecutionDelegate next
             return;
         }
 
-        if (!context.RequiresAuthentication())
+        if (!_authResolver.IsAuthenticationRequired(context))
         {
             _logger.LogInformation("No authentication required for this endpoint, skipping permissions check.");
             await next(context);
             return;
         }
-        var requiredRoles = context.GetRequiredRoles();
+        var requiredRoles = _authResolver.GetRequiredRoles(context);
 
         if(requiredRoles.Length == 0)
         {
diff --git a/application/CohortManager/src/Functions/Shared/Common/Authentication/Models/FunctionEndpoint.cs b/application/CohortManager/src/Functions/Shared/Common/Authentication/Models/FunctionEndpoint.cs
new file mode 100644
index 000000000..39ac077e6
--- /dev/null
+++ b/application/CohortManager/src/Functions/Shared/Common/Authentication/Models/FunctionEndpoint.cs
@@ -0,0 +1,11 @@
+namespace Common;
+
+public sealed class FunctionEndpoint
+{
+    public FunctionEndpoint(IEnumerable<object> metadata)
+    {
+        Metadata = new FunctionEndpointMetadataCollection(metadata);
+    }
+
+    public FunctionEndpointMetadataCollection Metadata { get; }
+}
diff --git a/application/CohortManager/src/Functions/Shared/Common/Authentication/Models/FunctionEndpointMetadataCollection.cs b/application/CohortManager/src/Functions/Shared/Common/Authentication/Models/FunctionEndpointMetadataCollection.cs
new file mode 100644
index 000000000..4e9f928b2
--- /dev/null
+++ b/application/CohortManager/src/Functions/Shared/Common/Authentication/Models/FunctionEndpointMetadataCollection.cs
@@ -0,0 +1,16 @@
+namespace Common;
+
+public sealed class FunctionEndpointMetadataCollection
+{
+    private readonly IReadOnlyList<object> _metadata;
+
+    public FunctionEndpointMetadataCollection(IEnumerable<object> metadata)
+    {
+        _metadata = metadata.ToArray();
+    }
+
+    public T? GetMetadata<T>() where T : class
+    {
+        return _metadata.OfType<T>().FirstOrDefault();
+    }
+}
diff --git a/application/CohortManager/src/Functions/Shared/Common/Extensions/AuditExtension.cs b/application/CohortManager/src/Functions/Shared/Common/Extensions/AuditExtension.cs
new file mode 100644
index 000000000..2a66241b8
--- /dev/null
+++ b/application/CohortManager/src/Functions/Shared/Common/Extensions/AuditExtension.cs
@@ -0,0 +1,22 @@
+namespace Common;
+
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Hosting;
+
+public static class AuditExtension
+{
+    public static IHostBuilder AddAuditLogging(this IHostBuilder hostBuilder, string serviceBusConnectionString)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(serviceBusConnectionString);
+
+        hostBuilder.ConfigureServices((context, services) =>
+        {
+            services.AddTransient<IAuditLogClient, AuditLogClient>();
+        });
+
+        hostBuilder.AddConfiguration<AuditClientConfig>();
+
+        return hostBuilder
+            .AddKeyedAzureQueues(serviceBusConnectionString, "AuditWriter");
+    }
+}
diff --git a/application/CohortManager/src/Functions/Shared/Common/Extensions/AuthenticationExtension.cs b/application/CohortManager/src/Functions/Shared/Common/Extensions/AuthenticationExtension.cs
index cecb1f8fc..b895028bd 100644
--- a/application/CohortManager/src/Functions/Shared/Common/Extensions/AuthenticationExtension.cs
+++ b/application/CohortManager/src/Functions/Shared/Common/Extensions/AuthenticationExtension.cs
@@ -9,6 +9,10 @@ public static IHostBuilder AddAuthentication(this IHostBuilder hostBuilder)
     {
 
         hostBuilder.AddConfiguration<AuthConfig>(out var authConfig);
+        hostBuilder.ConfigureServices((context, services) =>
+        {
+            services.AddSingleton<IFunctionContextAuthResolver, FunctionContextAuthResolver>();
+        });
         if(!authConfig.ByPassAuthentication)
         {
             hostBuilder.AddConfiguration<RoleConfig>();
@@ -19,6 +23,7 @@ public static IHostBuilder AddAuthentication(this IHostBuilder hostBuilder)
             });
             hostBuilder.ConfigureServices((context, services) =>
             {
+
                 services.AddSingleton<IAuthenticationService, JwtAuthentication>();
                 services.AddScoped<ICis2UserService,Cis2UserService>();
                 services.AddSingleton<IRoleManager, RoleManager>();
diff --git a/application/CohortManager/src/Functions/Shared/Common/Extensions/AzureQueueExtension.cs b/application/CohortManager/src/Functions/Shared/Common/Extensions/AzureQueueExtension.cs
index b51f121ed..1e109afde 100644
--- a/application/CohortManager/src/Functions/Shared/Common/Extensions/AzureQueueExtension.cs
+++ b/application/CohortManager/src/Functions/Shared/Common/Extensions/AzureQueueExtension.cs
@@ -83,4 +83,9 @@ public static IHostBuilder AddKeyedAzureQueues(this IHostBuilder hostBuilder, bo
         return hostBuilder;
     }
 
+    public static IHostBuilder AddKeyedAzureQueues(this IHostBuilder hostBuilder, string serviceBusConnectionString, string keyName)
+    {
+        return AddKeyedAzureQueues(hostBuilder, true, serviceBusConnectionString, keyName);
+    }
+
 }
diff --git a/application/CohortManager/src/Functions/Shared/Model/ParticipantAuditMessage.cs b/application/CohortManager/src/Functions/Shared/Model/ParticipantAuditMessage.cs
index 17446b7a3..3923720ff 100644
--- a/application/CohortManager/src/Functions/Shared/Model/ParticipantAuditMessage.cs
+++ b/application/CohortManager/src/Functions/Shared/Model/ParticipantAuditMessage.cs
@@ -1,6 +1,5 @@
 namespace Model;
 
-using System.Text.Json.Serialization;
 using Model.Enums;
 
 public class ParticipantAuditMessage
@@ -14,7 +13,5 @@ public class ParticipantAuditMessage
     public required string CreatedBy { get; set; }
     public int? ScreeningId { get; set; }
     public string? RawDataRef { get; set; }
-
-    [JsonIgnore]
     public object? RequestSnapshot { get; set; }
 }
diff --git a/application/CohortManager/src/Web/.env.example b/application/CohortManager/src/Web/.env.example
index a47d94bf7..c381e39fa 100644
--- a/application/CohortManager/src/Web/.env.example
+++ b/application/CohortManager/src/Web/.env.example
@@ -19,6 +19,7 @@ AUTH_CIS2_CLIENT_SECRET=
 
 # CIS2 RBAC
 COHORT_MANAGER_RBAC_CODE=000000000000
+COHORT_MANAGER_REMOVE_DUMMY_GP_CODE_RBAC_CODE=000000000000
 
 # API
 EXCEPTIONS_API_URL=https://localhost:3000
diff --git a/application/CohortManager/src/Web/app/components/overview.tsx b/application/CohortManager/src/Web/app/components/overview.tsx
index bd1681bd8..88de403e2 100644
--- a/application/CohortManager/src/Web/app/components/overview.tsx
+++ b/application/CohortManager/src/Web/app/components/overview.tsx
@@ -1,6 +1,8 @@
 import { Suspense } from "react";
+import { auth } from "@/app/lib/auth";
 import CardGroup from "@/app/components/cardGroup";
 import OverviewData from "@/app/components/overviewData";
+import { checkAccessToRemoveDummyGpCode } from "../lib/checkAccess";
 
 const skeletonExceptionItems = [
   {
@@ -34,7 +36,9 @@ const dummyGpCodeItems = [
   },
 ];
 
-export default function Overview() {
+export default async function Overview() {
+  const session = await auth();
+  const isDummyGpCodeUser = await checkAccessToRemoveDummyGpCode(session?.user.workgroups_codes || []);
   return (
     <main className="nhsuk-main-wrapper" id="maincontent" role="main">
       <div className="nhsuk-grid-row">
@@ -46,8 +50,12 @@ export default function Overview() {
           </Suspense>
           <h2>Reports</h2>
           <CardGroup items={reportItems} />
-          <h2>Dummy GP Code</h2>
-          <CardGroup items={dummyGpCodeItems} />
+          {isDummyGpCodeUser && (
+            <>
+              <h2>Dummy GP Code</h2>
+              <CardGroup items={dummyGpCodeItems} />
+            </>
+          )}
         </div>
       </div>
     </main>
diff --git a/application/CohortManager/src/Web/app/lib/checkAccess.ts b/application/CohortManager/src/Web/app/lib/checkAccess.ts
index 19acbe841..b92bb89c0 100644
--- a/application/CohortManager/src/Web/app/lib/checkAccess.ts
+++ b/application/CohortManager/src/Web/app/lib/checkAccess.ts
@@ -5,3 +5,11 @@ export async function checkAccess(workgroups_codes: string[]) {
     .filter((code) => code.length > 0);
   return rbacCodes.some((code) => workgroups_codes.includes(code));
 }
+
+export async function checkAccessToRemoveDummyGpCode(workgroups_codes: string[]) {
+  const rbacCodes = (process.env.COHORT_MANAGER_REMOVE_DUMMY_GP_CODE_RBAC_CODE || "")
+    .split(",")
+    .map((code) => code.trim())
+    .filter((code) => code.length > 0);
+  return rbacCodes.some((code) => workgroups_codes.includes(code));
+}
diff --git a/application/CohortManager/src/Web/app/lib/removeDummyGpCode.test.ts b/application/CohortManager/src/Web/app/lib/removeDummyGpCode.test.ts
index a61e0ac31..6f5b9e757 100644
--- a/application/CohortManager/src/Web/app/lib/removeDummyGpCode.test.ts
+++ b/application/CohortManager/src/Web/app/lib/removeDummyGpCode.test.ts
@@ -11,6 +11,10 @@ jest.mock("next/navigation", () => ({
   }),
 }));
 
+jest.mock("./auth", () => ({
+  auth: jest.fn().mockResolvedValue(null),
+}));
+
 const mockSafeParse = jest.fn();
 jest.mock("./formValidationSchemas", () => {
   return {
@@ -21,14 +25,20 @@ jest.mock("./formValidationSchemas", () => {
 });
 
 import { removeDummyGpCode } from "./removeDummyGpCode";
+import { auth } from "./auth";
 import { redirect } from "next/navigation";
 
 const mockRedirect = redirect as jest.MockedFunction<typeof redirect>;
+const mockAuth = auth as jest.MockedFunction<typeof auth>;
 
 describe("removeDummyGpCode", () => {
   beforeEach(() => {
     jest.clearAllMocks();
     process.env.REMOVE_DUMMY_GP_CODE_API_URL = "https://api.example.com";
+    mockAuth.mockResolvedValue({
+      idToken: "id-token",
+      accessToken: "access-token",
+    } as Awaited<ReturnType<typeof auth>>);
     global.fetch = jest.fn();
   });
 
@@ -163,6 +173,8 @@ describe("removeDummyGpCode", () => {
           method: "POST",
           headers: {
             "Content-Type": "application/json",
+            Authorization: "Bearer id-token",
+            "X-Access-Token": "Bearer access-token",
           },
           body: JSON.stringify({
             nhs_number: "1234567890",
@@ -206,6 +218,64 @@ describe("removeDummyGpCode", () => {
   });
 
   describe("unexpected errors", () => {
+    it("returns session error when auth tokens are missing", async () => {
+      mockSafeParse.mockReturnValue({
+        success: true,
+        data: {
+          nhsNumber: "1234567890",
+          forename: "Jane",
+          surname: "Smith",
+          dateOfBirth: "1990-01-15",
+          serviceNowTicketNumber: "CS1234567",
+        },
+      });
+
+      mockAuth.mockResolvedValue({
+        idToken: undefined,
+        accessToken: "access-token",
+      } as Awaited<ReturnType<typeof auth>>);
+
+      const formData = createFormData();
+      const result = await removeDummyGpCode(null, formData);
+
+      expect(result).toEqual({
+        error: "Your session has expired or is invalid. Please sign in again.",
+        values: expect.objectContaining({ nhsNumber: "1234567890" }),
+      });
+      expect(fetch).not.toHaveBeenCalled();
+    });
+
+    it("returns session error for 401/403 responses", async () => {
+      mockSafeParse.mockReturnValue({
+        success: true,
+        data: {
+          nhsNumber: "1234567890",
+          forename: "Jane",
+          surname: "Smith",
+          dateOfBirth: "1990-01-15",
+          serviceNowTicketNumber: "CS1234567",
+        },
+      });
+
+      global.fetch = jest
+        .fn()
+        .mockResolvedValueOnce({ status: 401 })
+        .mockResolvedValueOnce({ status: 403 });
+
+      const formData = createFormData();
+      const firstResult = await removeDummyGpCode(null, formData);
+      const secondResult = await removeDummyGpCode(null, formData);
+
+      expect(firstResult).toEqual({
+        error: "Your session has expired or is invalid. Please sign in again.",
+        values: expect.objectContaining({ nhsNumber: "1234567890" }),
+      });
+      expect(secondResult).toEqual({
+        error: "Your session has expired or is invalid. Please sign in again.",
+        values: expect.objectContaining({ nhsNumber: "1234567890" }),
+      });
+    });
+
     it("returns error state with generic message on non-202/non-400 response", async () => {
       mockSafeParse.mockReturnValue({
         success: true,
diff --git a/application/CohortManager/src/Web/app/lib/removeDummyGpCode.ts b/application/CohortManager/src/Web/app/lib/removeDummyGpCode.ts
index 1e1a7f60c..db050d9e8 100644
--- a/application/CohortManager/src/Web/app/lib/removeDummyGpCode.ts
+++ b/application/CohortManager/src/Web/app/lib/removeDummyGpCode.ts
@@ -1,6 +1,7 @@
 "use server";
 
 import { redirect } from "next/navigation";
+import { auth } from "@/app/lib/auth";
 import { removeDummyGpCodeSchema } from "@/app/lib/formValidationSchemas";
 
 export type RemoveDummyGpCodeState = {
@@ -68,14 +69,29 @@ export async function removeDummyGpCode(
   }
 
   const apiUrl = `${process.env.REMOVE_DUMMY_GP_CODE_API_URL}/api/RemoveDummyGPCode`;
+  const session = await auth();
+  const bearerToken = session?.idToken;
+  const accessToken = session?.accessToken;
+
+  const headers: Record<string, string> = {
+    "Content-Type": "application/json",
+  };
+
+  if (!bearerToken || !accessToken) {
+    return {
+      error: "Your session has expired or is invalid. Please sign in again.",
+      values: submittedValues,
+    };
+  }
+
+  headers.Authorization = `Bearer ${bearerToken}`;
+  headers["X-Access-Token"] = `Bearer ${accessToken}`;
 
   let response: Response;
   try {
     response = await fetch(apiUrl, {
       method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-      },
+      headers,
       body: JSON.stringify({
         nhs_number: parsedData.data.nhsNumber,
         forename: parsedData.data.forename,
@@ -96,5 +112,12 @@ export async function removeDummyGpCode(
     return { error: "The participant could not be found or the details provided do not match", values: submittedValues };
   }
 
+  if (response.status === 401 || response.status === 403) {
+    return {
+      error: "Your session has expired or is invalid. Please sign in again.",
+      values: submittedValues,
+    };
+  }
+
   return { error: "An unexpected error occurred. Please try again later.", values: submittedValues };
 }
diff --git a/application/CohortManager/src/Web/app/remove-dummy-gp-code/page.tsx b/application/CohortManager/src/Web/app/remove-dummy-gp-code/page.tsx
index 9bb8a117b..89e80c52a 100644
--- a/application/CohortManager/src/Web/app/remove-dummy-gp-code/page.tsx
+++ b/application/CohortManager/src/Web/app/remove-dummy-gp-code/page.tsx
@@ -1,6 +1,9 @@
 import type { Metadata } from "next";
+import { redirect } from "next/navigation";
 import Breadcrumb from "@/app/components/breadcrumb";
 import RemoveDummyGpCodeForm from "@/app/components/removeDummyGpCodeForm";
+import { auth } from "@/app/lib/auth";
+import { checkAccessToRemoveDummyGpCode } from "@/app/lib/checkAccess";
 
 export const metadata: Metadata = {
   title: `Remove Dummy GP Code - ${process.env.SERVICE_NAME} - NHS`,
@@ -11,6 +14,13 @@ export default async function Page(props: {
     readonly success?: string;
   }>;
 }) {
+  const session = await auth();
+  const isDummyGpCodeUser = await checkAccessToRemoveDummyGpCode(session?.user.workgroups_codes || []);
+
+  if (!isDummyGpCodeUser) {
+    redirect("/");
+  }
+
   const resolvedSearchParams = props.searchParams
     ? await props.searchParams
     : {};
diff --git a/infrastructure/tf-core/environments/development.tfvars b/infrastructure/tf-core/environments/development.tfvars
index 3ae6c6fcd..ad209066b 100644
--- a/infrastructure/tf-core/environments/development.tfvars
+++ b/infrastructure/tf-core/environments/development.tfvars
@@ -529,6 +529,7 @@ function_apps = {
       function_endpoint_name  = "RemoveDummyGPCode"
       app_service_plan_key    = "NonScaling"
       service_bus_connections = ["internal"]
+      key_vault_url          = "KeyVaultConnectionString"
       app_urls = [
         {
           env_var_name     = "RetrievePdsDemographicURL"
@@ -536,7 +537,9 @@ function_apps = {
         }
       ]
       env_vars_static = {
+        AuditTopicName                       = "participant-audit-topic"
         ServiceNowParticipantManagementTopic = "servicenow-participant-management"
+        UserInfoUrl                          = "https://am.nhsint.auth-ptl.cis2.spineservices.nhs.uk/openam/oauth2/realms/root/realms/NHSIdentity/realms/Healthcare/userinfo"
       }
     }
 
diff --git a/tests/UnitTests/AuditServicesTests/AuditWriterTests/AuditWriterTests.cs b/tests/UnitTests/AuditServicesTests/AuditWriterTests/AuditWriterTests.cs
index b98bd0c70..6a62296fa 100644
--- a/tests/UnitTests/AuditServicesTests/AuditWriterTests/AuditWriterTests.cs
+++ b/tests/UnitTests/AuditServicesTests/AuditWriterTests/AuditWriterTests.cs
@@ -5,6 +5,8 @@ namespace NHS.CohortManager.Tests.UnitTests.AuditServicesTests;
 using Microsoft.Azure.Functions.Worker;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+using Common;
 using Model;
 using Model.Enums;
 using Moq;
@@ -15,6 +17,7 @@ public class AuditWriterTests
 {
     private Mock<DataServicesContext> _mockDbContext;
     private Mock<DbSet<ParticipantAuditLog>> _mockDbSet;
+    private Mock<IBlobStorageHelper> _mockBlobStorageHelper;
     private Mock<ILogger<AuditWriter>> _mockLogger;
     private Mock<FunctionContext> _mockFunctionContext;
     private AuditWriter _auditWriterService;
@@ -39,10 +42,30 @@ public void Setup()
 
         _mockDbContext.Object.participantAuditLogs = _mockDbSet.Object;
 
+        _mockBlobStorageHelper = new Mock<IBlobStorageHelper>();
+        _mockBlobStorageHelper
+            .Setup(x => x.UploadFileToBlobStorageAndGetUri(
+                It.IsAny<string>(),
+                It.IsAny<string>(),
+                It.IsAny<BlobFile>(),
+                It.IsAny<bool>()))
+            .ReturnsAsync("https://storage.blob.core.windows.net/participant-audit/test.json");
+
         _mockLogger = new Mock<ILogger<AuditWriter>>();
         _mockFunctionContext = new Mock<FunctionContext>();
 
-        _auditWriterService = new AuditWriter(_mockDbContext.Object, _mockLogger.Object);
+        var config = Options.Create(new AuditConfig
+        {
+            ServiceBusConnectionString = "Endpoint=sb://unit-test/;SharedAccessKeyName=RootManageSharedAccessKey;SharedAccessKey=test=",
+            AzureWebJobsStorage = "UseDevelopmentStorage=true",
+            AuditTopicName = "audit-topic"
+        });
+
+        _auditWriterService = new AuditWriter(
+            _mockDbContext.Object,
+            _mockBlobStorageHelper.Object,
+            config,
+            _mockLogger.Object);
     }
 
     [TestMethod]
@@ -50,7 +73,7 @@ public async Task Run_ValidMessage_PersistsAuditLog()
     {
         // Arrange
         var audit = CreateAuditMessage();
-        audit.RawDataRef = "https://storage.blob.core.windows.net/participant-audit/test.json";
+        audit.RequestSnapshot = new { NhsNumber = audit.NhsNumber, Event = "Created" };
         var messageText = JsonSerializer.Serialize(audit, JsonOptions);
 
         // Act
@@ -63,16 +86,16 @@ public async Task Run_ValidMessage_PersistsAuditLog()
         Assert.AreEqual(audit.CorrelationId, saved.CorrelationId);
         Assert.AreEqual((int)audit.Source, saved.RecordSource);
         Assert.AreEqual(audit.CreatedBy, saved.CreatedBy);
-        Assert.AreEqual(audit.RawDataRef, saved.RawDataRef);
+        Assert.AreEqual("https://storage.blob.core.windows.net/participant-audit/test.json", saved.RawDataRef);
         _mockDbContext.Verify(x => x.SaveChangesAsync(default), Times.Once);
     }
 
     [TestMethod]
-    public async Task Run_ValidMessage_PersistsBlobRefFromMessage()
+    public async Task Run_ValidMessage_PersistsBlobRefFromBlobWrite()
     {
         // Arrange
         var audit = CreateAuditMessage();
-        audit.RawDataRef = "https://storage.blob.core.windows.net/participant-audit/test.json";
+        audit.RequestSnapshot = new { Field = "value" };
         var messageText = JsonSerializer.Serialize(audit, JsonOptions);
 
         // Act
@@ -81,6 +104,13 @@ public async Task Run_ValidMessage_PersistsBlobRefFromMessage()
         // Assert
         Assert.AreEqual(1, _addedEntities.Count);
         Assert.AreEqual("https://storage.blob.core.windows.net/participant-audit/test.json", _addedEntities[0].RawDataRef);
+        _mockBlobStorageHelper.Verify(
+            x => x.UploadFileToBlobStorageAndGetUri(
+                It.IsAny<string>(),
+                "participant-audit",
+                It.IsAny<BlobFile>(),
+                true),
+            Times.Once);
     }
 
     [TestMethod]
@@ -88,7 +118,6 @@ public async Task Run_WhenRawDataRefIsNull_SavesNullRefAndContinues()
     {
         // Arrange
         var audit = CreateAuditMessage();
-        audit.RawDataRef = null;
         var messageText = JsonSerializer.Serialize(audit, JsonOptions);
 
         // Act
@@ -98,6 +127,57 @@ public async Task Run_WhenRawDataRefIsNull_SavesNullRefAndContinues()
         Assert.AreEqual(1, _addedEntities.Count);
         Assert.IsNull(_addedEntities[0].RawDataRef);
         _mockDbContext.Verify(x => x.SaveChangesAsync(default), Times.Once);
+        _mockBlobStorageHelper.Verify(
+            x => x.UploadFileToBlobStorageAndGetUri(
+                It.IsAny<string>(),
+                It.IsAny<string>(),
+                It.IsAny<BlobFile>(),
+                It.IsAny<bool>()),
+            Times.Never);
+    }
+
+    [TestMethod]
+    public async Task Run_WhenBlobWriteReturnsNull_ThrowsAndDoesNotPersist()
+    {
+        // Arrange
+        _mockBlobStorageHelper
+            .Setup(x => x.UploadFileToBlobStorageAndGetUri(
+                It.IsAny<string>(),
+                It.IsAny<string>(),
+                It.IsAny<BlobFile>(),
+                It.IsAny<bool>()))
+            .ReturnsAsync((string?)null);
+
+        var audit = CreateAuditMessage();
+        audit.RequestSnapshot = new { Field = "value" };
+        var messageText = JsonSerializer.Serialize(audit, JsonOptions);
+
+        // Act & Assert
+        await Assert.ThrowsExceptionAsync<InvalidOperationException>(
+            async () => await _auditWriterService.Run(messageText, _mockFunctionContext.Object));
+        _mockDbContext.Verify(x => x.SaveChangesAsync(default), Times.Never);
+    }
+
+    [TestMethod]
+    public async Task Run_WhenBlobWriteThrows_ThrowsAndDoesNotPersist()
+    {
+        // Arrange
+        _mockBlobStorageHelper
+            .Setup(x => x.UploadFileToBlobStorageAndGetUri(
+                It.IsAny<string>(),
+                It.IsAny<string>(),
+                It.IsAny<BlobFile>(),
+                It.IsAny<bool>()))
+            .ThrowsAsync(new InvalidOperationException("Blob unavailable"));
+
+        var audit = CreateAuditMessage();
+        audit.RequestSnapshot = new { Field = "value" };
+        var messageText = JsonSerializer.Serialize(audit, JsonOptions);
+
+        // Act & Assert
+        await Assert.ThrowsExceptionAsync<InvalidOperationException>(
+            async () => await _auditWriterService.Run(messageText, _mockFunctionContext.Object));
+        _mockDbContext.Verify(x => x.SaveChangesAsync(default), Times.Never);
     }
 
     [TestMethod]
@@ -129,7 +209,7 @@ public async Task Run_ValidMessage_MapsAllFieldsCorrectly()
             CreatedDatetime = new DateTime(2026, 4, 8, 10, 30, 0, DateTimeKind.Utc),
             CreatedBy = "TestFunction",
             ScreeningId = 1,
-            RawDataRef = "https://storage.blob.core.windows.net/participant-audit/snapshot.json"
+            RequestSnapshot = new { ScreeningId = 1, Event = "Import" }
         };
         var messageText = JsonSerializer.Serialize(audit, JsonOptions);
 
@@ -146,7 +226,7 @@ public async Task Run_ValidMessage_MapsAllFieldsCorrectly()
         Assert.AreEqual("TestFunction", saved.CreatedBy);
         Assert.AreEqual(1, saved.ScreeningId);
         Assert.AreEqual(batchId, saved.BatchId);
-        Assert.AreEqual(audit.RawDataRef, saved.RawDataRef);
+        Assert.AreEqual("https://storage.blob.core.windows.net/participant-audit/test.json", saved.RawDataRef);
     }
 
     [TestMethod]
diff --git a/tests/UnitTests/ParticipantManagementServicesTests/ManageServiceNowParticipantTests/ManageServiceNowParticipantFunctionTests.cs b/tests/UnitTests/ParticipantManagementServicesTests/ManageServiceNowParticipantTests/ManageServiceNowParticipantFunctionTests.cs
index b4ed818d0..61644be60 100644
--- a/tests/UnitTests/ParticipantManagementServicesTests/ManageServiceNowParticipantTests/ManageServiceNowParticipantFunctionTests.cs
+++ b/tests/UnitTests/ParticipantManagementServicesTests/ManageServiceNowParticipantTests/ManageServiceNowParticipantFunctionTests.cs
@@ -25,7 +25,6 @@ public class ManageServiceNowParticipantFunctionTests
     private readonly Mock<IExceptionHandler> _handleExceptionMock = new();
     private readonly Mock<IDataServiceClient<ParticipantManagement>> _dataServiceClientMock = new();
     private readonly Mock<IQueueClient> _queueClientMock = new();
-    private readonly Mock<IAuditLogClient> _auditLogClientMock = new();
     private readonly ServiceNowParticipant _serviceNowParticipant;
     private readonly ManageServiceNowParticipantFunction _function;
     private readonly string _messageType1Request;
@@ -64,8 +63,7 @@ public ManageServiceNowParticipantFunctionTests()
             _httpClientFunctionMock.Object,
             _handleExceptionMock.Object,
             _dataServiceClientMock.Object,
-            _queueClientMock.Object,
-            _auditLogClientMock.Object
+            _queueClientMock.Object
         );
 
         _messageType1Request = JsonSerializer.Serialize(new SendServiceNowMessageRequestBody
@@ -314,7 +312,6 @@ public async Task Run_WhenServiceNowParticipantIsValidAndDoesNotExistInTheDataSt
         _dataServiceClientMock.VerifyNoOtherCalls();
 
         _queueClientMock.Verify();
-        _auditLogClientMock.Verify(x => x.AddAsync(It.IsAny<ParticipantAuditMessage>()), Times.Once);
         _queueClientMock.VerifyNoOtherCalls();
     }
 
@@ -431,7 +428,6 @@ public async Task Run_WhenServiceNowParticipantIsValidAndExistsInTheDataStoreAnd
         _dataServiceClientMock.VerifyNoOtherCalls();
 
         _queueClientMock.Verify();
-        _auditLogClientMock.Verify(x => x.AddAsync(It.IsAny<ParticipantAuditMessage>()), Times.Once);
         _queueClientMock.VerifyNoOtherCalls();
     }
 
@@ -496,7 +492,6 @@ public async Task Run_WhenSubscribesToNEMSFails_LogsErrorMessageButContinues(Htt
         _dataServiceClientMock.VerifyNoOtherCalls();
 
         _queueClientMock.Verify();
-        _auditLogClientMock.Verify(x => x.AddAsync(It.IsAny<ParticipantAuditMessage>()), Times.Once);
         _queueClientMock.VerifyNoOtherCalls();
 
         _loggerMock.VerifyLogger(LogLevel.Error, $"Failed to subscribe participant for updates. Case Number: {_serviceNowParticipant.ServiceNowCaseNumber}");
@@ -576,7 +571,6 @@ public async Task Run_WhenServiceNowParticipantIsVhrAndDoesNotExistInDataStore_A
         _dataServiceClientMock.VerifyNoOtherCalls();
 
         _queueClientMock.Verify();
-        _auditLogClientMock.Verify(x => x.AddAsync(It.IsAny<ParticipantAuditMessage>()), Times.Once);
         _queueClientMock.VerifyNoOtherCalls();
 
         _loggerMock.VerifyLogger(LogLevel.Information, "Participant not in participant management table, adding new record");
@@ -644,7 +638,6 @@ public async Task Run_WhenServiceNowParticipantIsNotVhrAndDoesNotExistInDataStor
         _dataServiceClientMock.VerifyNoOtherCalls();
 
         _queueClientMock.Verify();
-        _auditLogClientMock.Verify(x => x.AddAsync(It.IsAny<ParticipantAuditMessage>()), Times.Once);
         _queueClientMock.VerifyNoOtherCalls();
 
         _loggerMock.VerifyLogger(LogLevel.Information, "Participant not in participant management table, adding new record");
@@ -733,7 +726,6 @@ public async Task Run_WhenVhrParticipantExistsWithNullVhrFlag_SetsVhrFlagToTrue(
         _dataServiceClientMock.VerifyNoOtherCalls();
 
         _queueClientMock.Verify();
-        _auditLogClientMock.Verify(x => x.AddAsync(It.IsAny<ParticipantAuditMessage>()), Times.Once);
         _queueClientMock.VerifyNoOtherCalls();
 
         _loggerMock.VerifyLogger(LogLevel.Information, "Existing participant management record found, updating record 123");
@@ -811,7 +803,6 @@ public async Task Run_WhenParticipantExistsWithVhrFlagAlreadySet_MaintainsVhrFla
         _dataServiceClientMock.VerifyNoOtherCalls();
 
         _queueClientMock.Verify();
-        _auditLogClientMock.Verify(x => x.AddAsync(It.IsAny<ParticipantAuditMessage>()), Times.Once);
         _queueClientMock.VerifyNoOtherCalls();
 
         _loggerMock.VerifyLogger(LogLevel.Information, "Existing participant management record found, updating record 123");
@@ -886,7 +877,6 @@ public async Task Run_WhenNonVhrParticipantExistsWithNullVhrFlag_LeavesVhrFlagAs
         _dataServiceClientMock.VerifyNoOtherCalls();
 
         _queueClientMock.Verify();
-        _auditLogClientMock.Verify(x => x.AddAsync(It.IsAny<ParticipantAuditMessage>()), Times.Once);
         _queueClientMock.VerifyNoOtherCalls();
 
         _loggerMock.VerifyLogger(LogLevel.Information, "Existing participant management record found, updating record 123");
@@ -1083,34 +1073,4 @@ public async Task Run_WhenRequestHasNoRequiredGPCode_DoesntRaiseRule98Exception(
 
     }
 
-    [TestMethod]
-    public async Task Run_WhenAuditEnqueueCalled_CompletesSuccessfullyAndLogsAudit()
-    {
-        // Arrange
-        var json = JsonSerializer.Serialize(_matchingPdsDemographic);
-        _httpClientFunctionMock.Setup(x => x.SendGetResponse($"{_configMock.Object.Value.RetrievePdsDemographicURL}?nhsNumber={_serviceNowParticipant.NhsNumber}"))
-            .ReturnsAsync(new HttpResponseMessage(HttpStatusCode.OK)
-            {
-                Content = new StringContent(json, Encoding.UTF8, "application/json")
-            });
-        _httpClientFunctionMock.Setup(x => x.SendPost(_configMock.Object.Value.ManageNemsSubscriptionSubscribeURL,
-                It.IsAny<Dictionary<string, string>>()))
-            .ReturnsAsync(new HttpResponseMessage(HttpStatusCode.OK));
-        _dataServiceClientMock.Setup(client => client.GetSingleByFilter(
-            It.IsAny<Expression<Func<ParticipantManagement, bool>>>()))
-            .ReturnsAsync((ParticipantManagement)null!);
-        _dataServiceClientMock.Setup(x => x.Add(It.IsAny<ParticipantManagement>()))
-            .ReturnsAsync(true);
-        _queueClientMock.Setup(x => x.AddAsync(It.IsAny<BasicParticipantCsvRecord>(),
-                _configMock.Object.Value.CohortDistributionTopic))
-            .ReturnsAsync(true);
-        _handleExceptionMock.Setup(x => x.CreateTransformExecutedExceptions(It.IsAny<CohortDistributionParticipant>(), It.IsAny<string>(), It.IsAny<int>(), null))
-            .Returns(Task.CompletedTask);
-
-        // Act
-        await _function.Run(_serviceNowParticipant);
-
-        // Assert
-        _auditLogClientMock.Verify(x => x.AddAsync(It.IsAny<ParticipantAuditMessage>()), Times.Once);
-    }
 }
diff --git a/tests/UnitTests/ParticipantManagementServicesTests/RemoveDummyGPCodeTests/ReceiveRemoveDummyGPCodeFunctionTests.cs b/tests/UnitTests/ParticipantManagementServicesTests/RemoveDummyGPCodeTests/ReceiveRemoveDummyGPCodeFunctionTests.cs
index 6febd773a..832514f00 100644
--- a/tests/UnitTests/ParticipantManagementServicesTests/RemoveDummyGPCodeTests/ReceiveRemoveDummyGPCodeFunctionTests.cs
+++ b/tests/UnitTests/ParticipantManagementServicesTests/RemoveDummyGPCodeTests/ReceiveRemoveDummyGPCodeFunctionTests.cs
@@ -22,9 +22,12 @@ public class ReceiveRemoveDummyGpCodeFunctionTests
     private readonly CreateResponse _createResponse = new();
     private readonly Mock<IHttpClientFunction> _httpClientFunctionMock = new();
     private readonly Mock<IQueueClient> _queueClientMock = new();
+    private readonly Mock<IAuditLogClient> _auditLogClientMock = new();
     private readonly Mock<IOptions<RemoveDummyGpCodeConfig>> _configMock = new();
-    private readonly Mock<FunctionContext> _contextMock = new();
+    private readonly Mock<FunctionContext> _functionContextMock = new();
+    private readonly Mock<FunctionDefinition> _functionDefinitionMock = new();
     private readonly Mock<HttpRequestData> _httpRequestMock;
+    private readonly Mock<IFunctionContextAuthResolver> _authResolverMock = new();
     private readonly ReceiveRemoveDummyGpCodeFunction _function;
 
     public ReceiveRemoveDummyGpCodeFunctionTests()
@@ -41,12 +44,20 @@ public ReceiveRemoveDummyGpCodeFunctionTests()
             _createResponse,
             _httpClientFunctionMock.Object,
             _queueClientMock.Object,
-            _configMock.Object);
+            _configMock.Object,
+            _auditLogClientMock.Object,
+            _authResolverMock.Object);
 
-        _httpRequestMock = new Mock<HttpRequestData>(_contextMock.Object);
+        _authResolverMock.Setup(x => x.IsAuthenticationRequired(It.IsAny<FunctionContext>())).Returns(false);
+        _authResolverMock.Setup(x => x.GetCis2User(It.IsAny<FunctionContext>())).Returns((Cis2User?)null);
+        _functionContextMock.SetupGet(c => c.Items).Returns(new Dictionary<object, object>());
+        _functionDefinitionMock.SetupGet(fd => fd.EntryPoint).Returns(string.Empty);
+        _functionContextMock.SetupGet(c => c.FunctionDefinition).Returns(_functionDefinitionMock.Object);
+
+        _httpRequestMock = new Mock<HttpRequestData>(_functionContextMock.Object);
         _httpRequestMock.Setup(r => r.CreateResponse()).Returns(() =>
         {
-            var response = new Mock<HttpResponseData>(_contextMock.Object);
+            var response = new Mock<HttpResponseData>(_functionContextMock.Object);
             response.SetupProperty(r => r.Headers, new HttpHeadersCollection());
             response.SetupProperty(r => r.StatusCode);
             response.SetupProperty(r => r.Body, new MemoryStream());
@@ -102,6 +113,7 @@ public async Task Run_WhenRequestIsValidAndEnqueueSucceeds_ReturnsAcceptedAndPub
             .ReturnsAsync(true)
             .Verifiable();
 
+
         // Act
         var result = await _function.Run(_httpRequestMock.Object);
 
@@ -131,7 +143,7 @@ public async Task Run_WhenNhsNumberIsInvalid_ReturnsBadRequestWithInvalidNhsNumb
         // Assert
         Assert.AreEqual(HttpStatusCode.BadRequest, result.StatusCode);
         using var reader = new StreamReader(result.Body);
-        
+
         _httpClientFunctionMock.VerifyNoOtherCalls();
         _queueClientMock.VerifyNoOtherCalls();
     }
@@ -162,7 +174,7 @@ public async Task Run_WhenPdsRecordIsNotFound_ReturnsBadRequestWithPatientNotFou
         // Assert
         Assert.AreEqual(HttpStatusCode.BadRequest, result.StatusCode);
         using var reader = new StreamReader(result.Body);
-        
+
         _queueClientMock.VerifyNoOtherCalls();
     }
 
@@ -203,7 +215,7 @@ public async Task Run_WhenPdsDemographicDoesNotMatchRequest_ReturnsBadRequestWit
         // Assert
         Assert.AreEqual(HttpStatusCode.BadRequest, result.StatusCode);
         using var reader = new StreamReader(result.Body);
-        
+
         _queueClientMock.VerifyNoOtherCalls();
     }
 
@@ -262,7 +274,7 @@ public async Task Run_WhenRequestBodyIsMalformedJson_ReturnsBadRequestWithPatien
         // Assert
         Assert.AreEqual(HttpStatusCode.BadRequest, result.StatusCode);
         using var reader = new StreamReader(result.Body);
-        
+
         _httpClientFunctionMock.VerifyNoOtherCalls();
         _queueClientMock.VerifyNoOtherCalls();
     }
@@ -288,7 +300,7 @@ public async Task Run_WhenRequestValidationFails_ReturnsBadRequestWithPatientNot
         // Assert
         Assert.AreEqual(HttpStatusCode.BadRequest, result.StatusCode);
         using var reader = new StreamReader(result.Body);
-        
+
         _httpClientFunctionMock.VerifyNoOtherCalls();
         _queueClientMock.VerifyNoOtherCalls();
     }
@@ -381,7 +393,7 @@ public async Task Run_WhenPdsPayloadIsMalformedJson_ReturnsBadRequestWithPatient
         // Assert
         Assert.AreEqual(HttpStatusCode.BadRequest, result.StatusCode);
         using var reader = new StreamReader(result.Body);
-       
+
         _queueClientMock.VerifyNoOtherCalls();
     }
 
diff --git a/tests/UnitTests/ServiceNowMessageHandlerTests/ReceiveServiceNowMessageFunctionTests.cs b/tests/UnitTests/ServiceNowMessageHandlerTests/ReceiveServiceNowMessageFunctionTests.cs
index a9b78e8ed..5a3817dc7 100644
--- a/tests/UnitTests/ServiceNowMessageHandlerTests/ReceiveServiceNowMessageFunctionTests.cs
+++ b/tests/UnitTests/ServiceNowMessageHandlerTests/ReceiveServiceNowMessageFunctionTests.cs
@@ -28,6 +28,7 @@ public class ReceiveServiceNowMessageFunctionTests
     private Mock<IDataServiceClient<ServicenowCase>> _mockServiceNowCasesClient = new();
     private readonly Mock<IServiceNowClient> _mockServiceNowClient = new();
     private readonly ReceiveServiceNowMessageFunction _function;
+    private readonly Mock<IAuditLogClient> _mockAuditLogClient = new();
 
     public ReceiveServiceNowMessageFunctionTests()
     {
@@ -45,7 +46,7 @@ public ReceiveServiceNowMessageFunctionTests()
             ServiceNowParticipantManagementTopic = "servicenow-participant-management-topic",
             ServiceNowAssignmentGroup = "ITO Breast Screening 2nd Line"
         });
-        _function = new ReceiveServiceNowMessageFunction(_mockLogger.Object, _createResponse, _mockQueueClient.Object, _mockConfig.Object, _mockServiceNowCasesClient.Object, _mockServiceNowClient.Object);
+        _function = new ReceiveServiceNowMessageFunction(_mockLogger.Object, _createResponse, _mockQueueClient.Object, _mockConfig.Object, _mockServiceNowCasesClient.Object, _mockServiceNowClient.Object, _mockAuditLogClient.Object);
         _mockHttpRequest = new Mock<HttpRequestData>(_mockContext.Object);
 
         _mockHttpRequest.Setup(r => r.CreateResponse()).Returns(() =>
diff --git a/tests/UnitTests/SharedTests/AuditLogClientTests/AuditLogClientTests.cs b/tests/UnitTests/SharedTests/AuditLogClientTests/AuditLogClientTests.cs
new file mode 100644
index 000000000..28dc1a921
--- /dev/null
+++ b/tests/UnitTests/SharedTests/AuditLogClientTests/AuditLogClientTests.cs
@@ -0,0 +1,123 @@
+namespace NHS.CohortManager.Tests.UnitTests.SharedTests;
+
+using Common;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+using Model;
+using Model.Enums;
+using Moq;
+
+[TestClass]
+public class AuditLogClientTests
+{
+    private Mock<IQueueClient> _mockQueueClient;
+    private Mock<ILogger<AuditLogClient>> _mockLogger;
+    private AuditLogClient _client;
+
+    [TestInitialize]
+    public void Setup()
+    {
+        _mockQueueClient = new Mock<IQueueClient>();
+        _mockLogger = new Mock<ILogger<AuditLogClient>>();
+
+        var config = Options.Create(new AuditClientConfig
+        {
+            AuditTopicName = "audit-topic",
+            AzureWebJobsStorage = "UseDevelopmentStorage=true"
+        });
+
+        _client = new AuditLogClient(
+            _mockQueueClient.Object,
+            config,
+            _mockLogger.Object);
+    }
+
+    [TestMethod]
+    public async Task AddAsync_EnqueuesMessageWithoutMutatingRawDataRef()
+    {
+        // Arrange
+        var audit = CreateAuditMessage();
+        audit.RawDataRef = "existing-ref";
+        audit.RequestSnapshot = new { Field = "value" };
+
+        _mockQueueClient
+            .Setup(x => x.AddAsync(audit, "audit-topic"))
+            .ReturnsAsync(true);
+
+        // Act
+        await _client.AddAsync(audit);
+
+        // Assert
+        Assert.AreEqual("existing-ref", audit.RawDataRef);
+        _mockQueueClient.Verify(x => x.AddAsync(audit, "audit-topic"), Times.Once);
+    }
+
+    [TestMethod]
+    public async Task AddBatchAsync_EnqueuesMessagesWithoutMutatingRawDataRef()
+    {
+        // Arrange
+        var messages = new List<ParticipantAuditMessage>
+        {
+            CreateAuditMessage(),
+            CreateAuditMessage()
+        };
+
+        messages[0].RawDataRef = "ref-1";
+        messages[1].RawDataRef = null;
+        messages[0].RequestSnapshot = new { Field = "a" };
+        messages[1].RequestSnapshot = new { Field = "b" };
+
+        _mockQueueClient
+            .Setup(x => x.AddBatchAsync(It.IsAny<IEnumerable<ParticipantAuditMessage>>(), "audit-topic"))
+            .ReturnsAsync(0);
+
+        // Act
+        var result = await _client.AddBatchAsync(messages);
+
+        // Assert
+        Assert.AreEqual(0, result);
+        Assert.AreEqual("ref-1", messages[0].RawDataRef);
+        Assert.IsNull(messages[1].RawDataRef);
+        _mockQueueClient.Verify(
+            x => x.AddBatchAsync(
+                It.Is<IEnumerable<ParticipantAuditMessage>>(m => m.Count() == 2),
+                "audit-topic"),
+            Times.Once);
+    }
+
+    [TestMethod]
+    public async Task AddAsync_WhenQueueSendFails_LogsError()
+    {
+        // Arrange
+        var audit = CreateAuditMessage();
+        _mockQueueClient
+            .Setup(x => x.AddAsync(audit, "audit-topic"))
+            .ReturnsAsync(false);
+
+        // Act
+        await _client.AddAsync(audit);
+
+        // Assert
+        _mockLogger.Verify(
+            x => x.Log(
+                LogLevel.Error,
+                It.IsAny<EventId>(),
+                It.Is<It.IsAnyType>((v, t) => true),
+                It.IsAny<Exception>(),
+                It.IsAny<Func<It.IsAnyType, Exception?, string>>()),
+            Times.Once);
+    }
+
+    private static ParticipantAuditMessage CreateAuditMessage()
+    {
+        return new ParticipantAuditMessage
+        {
+            CorrelationId = Guid.NewGuid(),
+            NhsNumber = "1234567890",
+            Source = AuditSource.ManualAdd,
+            RecordSourceDesc = "Unit test",
+            CreatedDatetime = DateTime.UtcNow,
+            CreatedBy = "UnitTest"
+        };
+    }
+}
diff --git a/tests/UnitTests/SharedTests/AuthenticationTests/AuthenticationTests.cs b/tests/UnitTests/SharedTests/AuthenticationTests/AuthenticationTests.cs
index fbded805d..bcf67363b 100644
--- a/tests/UnitTests/SharedTests/AuthenticationTests/AuthenticationTests.cs
+++ b/tests/UnitTests/SharedTests/AuthenticationTests/AuthenticationTests.cs
@@ -18,7 +18,6 @@ public async Task Cis2AuthMiddleware_BypassAuthentication_CallsNext()
         var logger = new Mock<ILogger<Cis2AuthMiddleware>>();
         var createResponse = new Mock<ICreateResponse>();
         var authService = new Mock<IAuthenticationService>();
-        var cis2UserService = new Mock<ICis2UserService>();
         var options = Options.Create(new AuthConfig
         {
             AuthMetaDataUrl = "https://example.com/.well-known/openid-configuration",
@@ -26,8 +25,9 @@ public async Task Cis2AuthMiddleware_BypassAuthentication_CallsNext()
             UserInfoUrl = "https://example.com/userinfo",
             ByPassAuthentication = true
         });
+        var authResolver = new Mock<IFunctionContextAuthResolver>();
 
-        var sut = new Cis2AuthMiddleware(logger.Object, createResponse.Object, authService.Object, cis2UserService.Object, options);
+        var sut = new Cis2AuthMiddleware(logger.Object, createResponse.Object, authService.Object, options, authResolver.Object);
         var context = new Mock<FunctionContext>();
         var nextCalled = false;
         FunctionExecutionDelegate next = _ =>
@@ -50,6 +50,7 @@ public async Task PermissionsMiddleware_BypassAuthentication_CallsNext()
         var createResponse = new Mock<ICreateResponse>();
         var roleManager = new Mock<IRoleManager>();
         var logger = new Mock<ILogger<PermissionsMiddleware>>();
+        var authresolver = new Mock<IFunctionContextAuthResolver>();
         var options = Options.Create(new AuthConfig
         {
             AuthMetaDataUrl = "https://example.com/.well-known/openid-configuration",
@@ -58,7 +59,7 @@ public async Task PermissionsMiddleware_BypassAuthentication_CallsNext()
             ByPassAuthentication = true
         });
 
-        var sut = new PermissionsMiddleware(createResponse.Object, roleManager.Object, logger.Object, options);
+        var sut = new PermissionsMiddleware(createResponse.Object, roleManager.Object, logger.Object, options, authresolver.Object);
         var context = new Mock<FunctionContext>();
         var nextCalled = false;
         FunctionExecutionDelegate next = _ =>