Forum Discussion
Not able to turn on - Audit Logs Search
Dears,
Can you please help me?
I have an Azure Tenant which has my personal account (email address removed for privacy reasons) as its Onwer. Its the account with which I have created the Tenant.
Because its a personal account, I have created inside this tenant an Entra ID user : email address removed for privacy reasons
Using this Entra ID user (which is a Global Administrator in the Azure Tenant) , I have logged into the new Purview Portal
I saw that I was not able to work with the purview functionality that I wish , which is : Information protection.
I read about the root cause and saw that it was because this Entra User did not have a proper license, hence I have bought one licence : Office 365 E5 EEA (no Teams)
After, I got in again into purview and I was able to create sensitivity labels.
I was also able to start creating an Auto-Labeling policy, but when I try to save it. It says that I need to turn on Audit Log Search. I try to do it.
In Purview, I go to Solutions->Audit and click on Search. But I receive the message "Sorry we're having trouble finding out if activity is being recorded"
I click on the button "Start Recording user and admin activity" and I still see the same message.
What Can I do to start this?
Thank you, Pedro
P.S - I have in the azure tenant, for this Entra Id user, Global Administrator permissions and Compliance Administrator Permissions and Security Administrator permissions.
2 Replies
- riverazureCopper Contributor
Thank you very much
- Joe StockerBronze Contributor
Hey Pedro, it can take up to 60 minutes for auditing to fully activate. In some cases I have seen it take 24 hours. If the error is still happening, try these EXO PowerShell cmdlets below to check and enforce the status.
Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled
If UnifiedAuditLogIngestionEnabled shows False, auditing isn’t turned on. Enable it by running:
Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true