Forum Discussion

Dean_Gross's avatar
Dean_Gross
Silver Contributor
Mar 14, 2018

Audit Log Discrepancy - Remove-UnifiedGroup Activity

In the S&C Center, I can do an Audit Log search and I see an activity that is called Remove-UnifiedGroup. I would like to find all of these activities, however, when I try to do another search that u...
security
Dean_Gross's avatar
Dean_Gross
Silver Contributor
Mar 14, 2018

Thanks for running a test using powershell, I have been having all kinds of other issues with the logs in this tenant and this looks like another data problem. I used that same activity in the UI, and did not get the expected result.

This image shows the activity that I performed (filtered by my account). When I remove my account and add the Deleted Group activity I don't any results. When I run the script you provided me I don't get the result either. If i change my date range, i get some results, but not the event shown in my screen shot. 

The UI is showing the event that occurred yesterday, but powershell is only showing events through 2 days ago. Its very strange.

 

TonyRedmond's avatar
TonyRedmond
MVP
Mar 14, 2018

It could be a data glitch with audit data flowing into the audit log. I'd file a support case and ask Microsoft to check things out.

 

PowerShell and the search UI look at the same data. I see the same in both places. One thing I did notice is that you see a Deleted Group record when a group is soft-deleted and a Hard Delete Group record when it is eventually removed permanently.