Forum Discussion

riverazure's avatar
riverazure
Tin Contributor
Mar 11, 2025

Audit Log Search

Dears, 

Can you please help me?

I have an Azure Tenant which has my personal account (email address removed for privacy reasons) as its Onwer. Its the account with which I have created the Tenant. 

Because its a personal account, I have created inside this tenant an Entra ID user : email address removed for privacy reasons

Using this Entra ID user (which is a Global Administrator in the Azure Tenant) , I have logged into the new Purview Portal 

I saw that I was not able to work with the purview functionality that I wish , which is : Information protection. 

I read about the root cause and saw that it was because this Entra User did not have a proper license, hence I have bought one licence : Office 365 E5 EEA (no Teams)

After, I got in again into purview and I was able to create sensitivity labels. 

I was also able to start creating an Auto-Labeling policy, but  when I try to save it. It says that I need to turn on Audit Log Search. I try to do it. 

In Purview, I go to Solutions->Audit and click on Search. But I receive the message "Sorry we're having trouble finding out if activity is being recorded"

I click on the button "Start Recording user and admin activity" and I still see the same message.

What Can I do to start this?

Thank you, Pedro


P.S - I have in the azure tenant, for this Entra Id user,   Global Administrator permissions and Compliance Administrator Permissions and Security Administrator permissions.

 

 

1 Reply

  • MoritzG's avatar
    MoritzG
    Iron Contributor
    Mar 14, 2025

    You could try to enable Audit Log Search using PowerShell:

     

    Install and connect to Exchange Online PowerShell:

    Install-Module ExchangeOnlineManagement  
Import-Module ExchangeOnlineManagement  
Connect-ExchangeOnline -UserPrincipalName email address removed for privacy reasons

    Check audit status:

    Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled

    If disabled, enable it:

    Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true


    Wait up to 60 mins. Also, try clearing your browser cache or using another browser. If the issue persists, check the Microsoft 365 Service Health Dashboard.

    After that idk either :D

    Best regards!