Forum Discussion
riverazure
Mar 11, 2025Copper Contributor
Not able to turn on the Audit Log Search
Dears,
Can you please help me?
I have an Azure Tenant which has my personal account (email address removed for privacy reasons) as its Onwer. Its the account with which I have created the Tenant.
Because its a personal account, I have created inside this tenant an Entra ID user : email address removed for privacy reasons
Using this Entra ID user (which is a Global Administrator in the Azure Tenant) , I have logged into the new Purview Portal
I saw that I was not able to work with the purview functionality that I wish , which is : Information protection.
I read about the root cause and saw that it was because this Entra User did not have a proper license, hence I have bought one licence : Office 365 E5 EEA (no Teams)
After, I got in again into purview and I was able to create sensitivity labels.
I was also able to start creating an Auto-Labeling policy, but when I try to save it. It says that I need to turn on Audit Log Search. I try to do it.
In Purview, I go to Solutions->Audit and click on Search. But I receive the message "Sorry we're having trouble finding out if activity is being recorded"
I click on the button "Start Recording user and admin activity" and I still see the same message.
What Can I do to start this?
Thank you, Pedro
P.S - I have in the azure tenant, for this Entra Id user, Global Administrator permissions and Compliance Administrator Permissions and Security Administrator permissions.
1 Reply
Sort By
- milgo
Microsoft
Typically you would need permissions to be assigned on the Purview Portal in order to accomplish this. Please refer to the documentation here- https://learn.microsoft.com/en-us/purview/audit-search?tabs=microsoft-purview-portal#before-you-search-the-audit-log
There is a pre-requisite to have the Audit Manager role or the Audit Reader role groups on the Permissions Page. Under Settings, find Role Groups and then Audit Manager role group which you should assign yourself. Once done, proceed to test your scenario. As best practice, wat for changes to propagate