Audit Log fields blank

[Elliot Munro]

Hi,

We're having some issues with the Office 365 Management API/Unified Audit Log. Specifically the Azure Active Directory logs. 

For the Office 365 Management API, we're receiving the webhook notifications to download the content, however when we download the log, the ResultStatus and the Operation field are both blank.

Previously, these fields would contain ResultStatus: Succeeded or Operation: UserLoggedIn. We'd then be able to use this info to determine whether the operation was successful or not.

These logs also do not contain data when retrieved via Search-Unified Audit Log, or when searched via the portal at protection.office.com. The below is the same log via the Search-UnifiedAuditLog cmdlet.

This issue seems to have been occurring since the 2nd of May. This was the last time the Unified Audit Log contains info relating to ResultStatus, Operation, and UserAgent.

It seems that it is the Azure Active Directory logging that is incomplete as the Exchange logs seem to be OK.

We are experiencing this problem across all customers that we are running our tooling on. 

Thanks,
Elliot

[#2]

I'm also seeing this behavior (blank fields for Operation and ResultStatus) in logs pulled within the past week, but dating back further (at least as early as 7 May 2018).  I unfortunately don't have an answer, but in my case this information is critical to completing an investigation, thank you for posting the question!

[#3]

I logged a support ticket about this and receive noticed on Friday that they would refresh

[#4]

Posted the last message too early from my phone. :)

Anyway, I logged a support ticket about this and received notice that they have processed a resync on the affected tenant.

The issue was affecting all of our customer tenants, however in the last 72 hours we are receiving backdated webhook notifications and audit logs with the missing data now visible.

Hopefully this is the case in all other affected tenants too.

[#5]

Just spoke to a Microsoft support technician and he confirmed this was a global issue. He said a patch has been rolled out to all tenants to restore the missing log data.

[#6]

Thank you for updating this thread, I'm hopeful this patch will cross our workload sometime soon - I re-ran our affected reports and haven't seen the fix yet (still empty fields), but I'll stay on top of it and hopefully get some results.  Thanks again.