Audit Log Trimming removed from SharePoint Online

[hvandesa]

We got a surprise today: "Given this audit experience is powered by the Unified Audit pipeline, we no longer support Trimming as a feature. You will be able to access files that have been trimmed so far in the document library that you have set for this purpose." We create a Site collection for each project - and keep audit logs for the entire lifecycle of the project - which could be years. We had just started implementing an online version of our project sites in the last couple of months, but that may stop now that Microsoft has removed the ability to trim out audit logs to a report that can be saved. Does anyone else keep audit logs on their sites for longer than 90 days? If so, how are you extracting and keeping the data?

[#2]

Well, I don't really see a problem on this and I couls say that in the Audit Log Search you have much more information than the one you have in the SPO Audit. The Audit Log Search can also be done using PowerShell and via API so you could still do the same process you have now creating a programmable task that extracts the required Audit Log information, exporte it to a CSV / Excel File and store it in a specific location

[#3]

@Juan Carlos González Martín  I am afraid that this is not an option when the user who needs the log is not a SCC admin and still needs the access to logs on daily basis. The reports on site collection level were extremely useful. Any ideas for a replacement?

[#4]

@Malgorzata_SITS - We have the same problem.  We have far more people in the "site collection admin" role than the "security reader" role.  When Audit Log Trimming worked, site collection admins could self-serve for their audit and troubleshooting needs.  Now they need to contact security staff.  Also, with hundreds of site collections and transaction throttling, it's not practical for us to re-create the individual site collection audit logs.  Finally, we never saw any notification of this change in the O365 Message Center, so our first knowledge came when the feature simply stopped working.  Not happy.

[#5]

@Malgorzata_SITS - And it adds insult to injury that the official documentation (https://support.office.com/en-us/article/configure-audit-settings-for-a-site-collection-a9920c97-38c...) still lists Audit Log Trimming as a working feature.  What's the difference between a revoked feature and a bug when the documentation lists the capability as currently active?  Not happy.