Forum Discussion

riverazure's avatar
riverazure
Copper Contributor
Mar 12, 2025

Not able to turn on - Audit Logs Search

Dears, 

Can you please help me?

I have an Azure Tenant which has my personal account (email address removed for privacy reasons) as its Onwer. Its the account with which I have created the Tenant. 

Because its a personal account, I have created inside this tenant an Entra ID user : email address removed for privacy reasons

Using this Entra ID user (which is a Global Administrator in the Azure Tenant) , I have logged into the new Purview Portal 

I saw that I was not able to work with the purview functionality that I wish , which is : Information protection. 

I read about the root cause and saw that it was because this Entra User did not have a proper license, hence I have bought one licence : Office 365 E5 EEA (no Teams)

After, I got in again into purview and I was able to create sensitivity labels. 

I was also able to start creating an Auto-Labeling policy, but  when I try to save it. It says that I need to turn on Audit Log Search. I try to do it. 

In Purview, I go to Solutions->Audit and click on Search. But I receive the message "Sorry we're having trouble finding out if activity is being recorded"

I click on the button "Start Recording user and admin activity" and I still see the same message.

What Can I do to start this?

Thank you, Pedro


P.S - I have in the azure tenant, for this Entra Id user,   Global Administrator permissions and Compliance Administrator Permissions and Security Administrator permissions.

 

 

2 Replies

  • Joe Stocker's avatar
    Joe Stocker
    Bronze Contributor

    Hey Pedro, it can take up to 60 minutes for auditing to fully activate. In some cases I have seen it take 24 hours. If the error is still happening, try these EXO PowerShell cmdlets below to check and enforce the status.

    Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled

    If UnifiedAuditLogIngestionEnabled shows False, auditing isn’t turned on. Enable it by running:
    Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true

Resources