Forum Discussion
Solved
Audit log search error: "Fail to opt in, please refresh"
I spotted this curious little error today, anyone know what may be causing it? I'm trying to pull all user audit logs for a specific SPO site.
Microsoft have confirmed a fix has been deployed! See below from the Microsoft engineer -
Please be informed that the fix has been deployed to customers that are receiving the alarm "Fail to opt-in, please refresh" on the Audit log search page. This alarm "Fail to opt-in, please refresh" can be ignored, as the search is not currently affected.
The fix has been checked, but it may still need 3 more weeks to be deployed fully to all data center servers
I opened a support ticket with Microsoft about this on Friday 18th Oct 2019.
I was given the following information from their health portal -
Issue: fail to opt in, please refresh.
Resolution:
•EX193067
Exchange Online - Can't get fresh audit log data
Impact Description
Admins are unable to obtain fresh audit log data from the Security and Compliance Center (SCC).
Latest Message
Title: Can't get fresh audit log data User Impact: Admins are unable to obtain fresh audit log data from the Security and Compliance Center (SCC). More info: Audit log data after Sunday, October 13, 2019, is not available in the SCC. Current status: We're continuing to monitor progress of the queues to ensure data after Sunday, October 13, 2019, is replicated to the SCC. The queues are currently draining as expected, and we anticipate drainage to potentially complete in 24 hours. Scope of impact: Your organization is affected by this event. Impact is specific to admins in your organization attempting to collect fresh audit log data in the SCC. Start time: Monday, October 14, 2019, at 1:00 AM UTC Root cause: A portion of infrastructure that stores data reached storage capacity, causing processing delays, resulting in impact. Next update by: Tuesday, October 15, 2019, at 8:00 PM UTC
I was then told to keep an eye on the health portal for further updates. Several days later and there have been no updates on the health portal and the issue is still occurring. I have reopened my support ticket with Microsoft and am awaiting a call back.
REGHA1205 Have you received any further updates, I am seeing this message constantly and refresh has no effect,
No further updates from Microsoft.
I will chase them again today.
I have had a reply from microsoft, just as I suspected....
Please be informed that our engineers are working towards achieving a resolution to the issue, and admins will be able to manage Audit Log Search, once the fix reaches their respective environments.
