Forum Discussion
Differences between S&C Compliance Center Audit Logs and Azure AD Audit Logs
I am seeing inconsistencies between these 2 sets of logs. For example, Azure AD shows me that Office Groups were recently created and these activities don't show up in the Unified Log in the S&C Cent...
In general the AAD logs are the "source of authority", and there is some background process that funnels them into the SCC audit logs. The process is known to break, often. Our folks collect tons of these as part of the reporting product, and we're always running into issues.
And yes, they also use different schemas, as you've noticed.