Forum Discussion
Audit Log changes
I'm not sure if it's related but we're having issues with the Office 365 Management API, which contains the same logs as the Unified Audit Log.
The logs are coming in with empty Operation and ResultStatus fields, meaning our alerting engine isn't able to notify us for bulk failed, or successful logins from suspicious IPs.
To get these complete logs, I've had to run Search-UnifiedAuditLog, where the Operation and ResultStatus field is present for the same logs. Edit: I just retested this, and it seems that the data isn't there either. We haven't received any ResultStatus or Operation info since the 2nd of May for any of our customers.
I'll log it as a separate post, but there may be some issues with the service lately.
- VasilMichevMay 15, 2018MVP
That one definitely calls for a support ticket.
- Elliot MunroMay 15, 2018Copper ContributorYep I've just logged one, I'll update with how it goes