Forum Discussion

hvandesa's avatar
hvandesa
Copper Contributor
Aug 29, 2019

Audit Log Trimming removed from SharePoint Online

We got a surprise today: "Given this audit experience is powered by the Unified Audit pipeline, we no longer support Trimming as a feature. You will be able to access files that have been trimmed so f...
audit
jcgonzalezmartin's avatar
jcgonzalezmartin
MVP
Aug 29, 2019
Well, I don't really see a problem on this and I couls say that in the Audit Log Search you have much more information than the one you have in the SPO Audit. The Audit Log Search can also be done using PowerShell and via API so you could still do the same process you have now creating a programmable task that extracts the required Audit Log information, exporte it to a CSV / Excel File and store it in a specific location
  • Malgorzata_SITS's avatar
    Malgorzata_SITS
    Copper Contributor
    Oct 17, 2019

    jcgonzalezmartin  I am afraid that this is not an option when the user who needs the log is not a SCC admin and still needs the access to logs on daily basis. The reports on site collection level were extremely useful. Any ideas for a replacement?

    • TedGoessling's avatar
      TedGoessling
      Copper Contributor
      Oct 28, 2019

      Malgorzata_SITS - And it adds insult to injury that the official documentation (https://support.office.com/en-us/article/configure-audit-settings-for-a-site-collection-a9920c97-38c0-44f2-8bcb-4cf1e2ae22d2) still lists Audit Log Trimming as a working feature.  What's the difference between a revoked feature and a bug when the documentation lists the capability as currently active?  Not happy.

    • TedGoessling's avatar
      TedGoessling
      Copper Contributor
      Oct 28, 2019

      Malgorzata_SITS - We have the same problem.  We have far more people in the "site collection admin" role than the "security reader" role.  When Audit Log Trimming worked, site collection admins could self-serve for their audit and troubleshooting needs.  Now they need to contact security staff.  Also, with hundreds of site collections and transaction throttling, it's not practical for us to re-create the individual site collection audit logs.  Finally, we never saw any notification of this change in the O365 Message Center, so our first knowledge came when the feature simply stopped working.  Not happy.

Resources