Incomplete data from Search-UnifiedAuditLog cmdlet for AzureAD record type

%3CLINGO-SUB%20id%3D%22lingo-sub-240805%22%20slang%3D%22en-US%22%3EIncomplete%20data%20from%20Search-UnifiedAuditLog%20cmdlet%20for%20AzureAD%20record%20type%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-240805%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EFrom%20the%20below%20cmdlet%20I%20got%20%3CSTRONG%3EAuditData%3C%2FSTRONG%3E%20parameter%26nbsp%3Bas%20an%20incomplete%26nbsp%3BJSON%20string.%3C%2FP%3E%3CP%3E%3CEM%3E%3CSTRONG%3ESearch-UnifiedAuditLog%20-Operations%20'Update%20User.'%20-RecordType%20azureactivedirectory%20-StartDate%20(Get-Date).AddDays(-30)%20-EndDate%20(Get-Date)%3C%2FSTRONG%3E%3C%2FEM%3E%3C%2FP%3E%3CP%3EI%20attached%20the%20output%20which%20i%20got.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F44617i0FBD6A8EB64FB02C%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22AuditData.PNG%22%20title%3D%22AuditData.PNG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3EPlease%20help%20me%20with%20this%20case%20!!!%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-240805%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-355136%22%20slang%3D%22en-US%22%3ERe%3A%20Incomplete%20data%20from%20Search-UnifiedAuditLog%20cmdlet%20for%20AzureAD%20record%20type%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-355136%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Ryan%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20am%20executing%20the%20Search-UnifiedAuditLog%20power%20shell%20command%20and%20getting%20error%20below.%3C%2FP%3E%3CP%3E%3CBR%20%2F%3EWhich%20module%20i%20need%20to%20install%20in%20Power%20Shell%20for%26nbsp%3B%20%E2%80%98Search-UnifiedAuditLog%20%E2%80%98%26nbsp%3B%20command%20%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESearch-UnifiedAuditLog%20%3A%20%3CSTRONG%3EThe%20term%20%E2%80%98Search-UnifiedAuditLog%E2%80%99%20is%20not%20recognized%3C%2FSTRONG%3E%20as%20the%20name%20of%20a%20cmdlet%2C%20function%2C%20script%20file%2C%20or%20operable%20program.%20Check%20the%20spelling%20of%3CBR%20%2F%3Ethe%20name%2C%20or%20if%20a%20path%20was%20included%2C%20verify%20that%20the%20path%20is%20correct%20and%20try%20again.%3CBR%20%2F%3EAt%20line%3A11%20char%3A1%3CBR%20%2F%3E%2B%20Search-UnifiedAuditLog%20-StartDate%2019%2F02%2F2019%20-EndDate%2020%2F02%2F2019%20-Rec%20%E2%80%A6%3CBR%20%2F%3E%2B%20~~~~~~~~~~~~~~~~~~~~~~%3CBR%20%2F%3E%2B%20CategoryInfo%20%3A%20ObjectNotFound%3A%20(Search-UnifiedAuditLog%3AString)%20%5B%5D%2C%20CommandNotFoundException%3CBR%20%2F%3E%2B%20FullyQualifiedErrorId%20%3A%20CommandNotFoundException%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%3C%2FP%3E%3CP%3EMoz%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-327199%22%20slang%3D%22en-US%22%3ERe%3A%20Incomplete%20data%20from%20Search-UnifiedAuditLog%20cmdlet%20for%20AzureAD%20record%20type%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-327199%22%20slang%3D%22en-US%22%3E%3CP%3EI%20imagined%20that%20you'd%20like%20the%20current%20state%20of%20affairs...%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-326690%22%20slang%3D%22en-US%22%3ERe%3A%20Incomplete%20data%20from%20Search-UnifiedAuditLog%20cmdlet%20for%20AzureAD%20record%20type%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-326690%22%20slang%3D%22en-US%22%3E%3CP%3EOh%20the%20wonders%20of%20the%20DevOps%20world...%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-326565%22%20slang%3D%22en-US%22%3ERe%3A%20Incomplete%20data%20from%20Search-UnifiedAuditLog%20cmdlet%20for%20AzureAD%20record%20type%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-326565%22%20slang%3D%22en-US%22%3E%3CP%3EThe%20problem%20still%20exists.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EMicrosoft%20applied%20an%20update%20to%20the%20code%20and%20the%20result%20is%20even%20worse%20than%20before.%20The%20audit%20records%20for%20Azure%20AD%20group%20operations%20now%20contain%20a%20lot%20of%20detail%2C%20but%20the%20audit%20data%20is%20badly%20terminated.%20The%20net%20result%20is%20that%20these%20events%20don't%20show%20up%20in%20the%20SCC.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EMessages%20have%20been%20sent%20to%20Microsoft%20to%20ask%20if%20they%20can%20look%20at%20the%20issue%20again.%20It's%20sad%2C%20but%20this%20has%20been%20a%20problem%20that%20started%20in%20August%202018...%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ETR%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-326548%22%20slang%3D%22en-US%22%3ERe%3A%20Incomplete%20data%20from%20Search-UnifiedAuditLog%20cmdlet%20for%20AzureAD%20record%20type%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-326548%22%20slang%3D%22en-US%22%3E%3CP%3EDear%20all%2C%3C%2FP%3E%0A%3CP%3EAny%20news%20for%20that%20question%20%3F%3C%2FP%3E%0A%3CP%3EI%20tried%20to%20use%20the%20Web%20interface%20to%20export%20the%20data%20and%20discovered%20that%20AuditData%20field%20limitation%20truncated%20to%203000%20chars%3CBR%20%2F%3EI%20created%20a%20dedicated%20PowerShell%20script%20using%20the%20special%20command%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B-%26nbsp%3BSearch-UnifiedAuditLog%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAnd%20found%20the%20truncate%20is%20also%20done%20at%20this%20Powershell%20level%2C%20so%20when%20that%20issue%20will%20be%20fixed%20%3F%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThanks%20for%20your%20feedback.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EPS%3A%26nbsp%3B%3C%2FP%3E%0A%3CP%3EI%20posted%20a%20script%20to%20manage%20that%20AuditLog%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B-%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2FOffice-365%2FPowerShell-script-to-export-Audit-log-search-Data-based-on%2Fm-p%2F326589%23M19622%22%20target%3D%22_blank%22%3Ehttps%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2FOffice-365%2FPowerShell-script-to-export-Audit-log-search-Data-based-on%2Fm-p%2F326589%23M19622%3C%2FA%3E%3C%2FP%3E%0A%3CP%3EThe%20limitation%20still%20exist%20with%20the%20PS%20command%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EFab%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-285836%22%20slang%3D%22en-US%22%3ERe%3A%20Incomplete%20data%20from%20Search-UnifiedAuditLog%20cmdlet%20for%20AzureAD%20record%20type%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-285836%22%20slang%3D%22en-US%22%3E%3CP%3EPlease%20find%20attached%20an%20sample%20of%20the%20audit%20log%20(value%20of%20%22AuditData%22)%2C%20i%20have%20replaced%20some%20values%20with%20an%20place-holder%20(%22foobar%22)%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%7B%22CreationTime%22%3A%222018-11-10T20%3A00%3A14%22%2C%22Id%22%3A%22foobar%22%2C%22Operation%22%3A%22CrmDefaultActivity%22%2C%22OrganizationId%22%3A%22foobar%22%2C%22RecordType%22%3A21%2C%22ResultStatus%22%3A%22Success%22%2C%22UserKey%22%3A%22Unknown%22%2C%22UserType%22%3A2%2C%22Version%22%3A1%2C%22Workload%22%3A%22CRM%22%2C%22ClientIP%22%3A%22127.0.0.1%22%2C%22ObjectId%22%3A%22Create%20email%22%2C%22UserId%22%3A%22drt%40alfapeople.com%22%2C%22CrmOrganizationUniqueName%22%3A%22foobar%22%2C%22Fields%22%3A%5B%7B%22Name%22%3A%22subject%22%2C%22Value%22%3A%22foobar%22%7D%2C%7B%22Name%22%3A%22description%22%2C%22Value%22%3A%22foobar%22%7D%2C%7B%22Name%22%3A%22ownerid%22%2C%22Value%22%3A%22foobar%22%7D%2C%7B%22Name%22%3A%22from%22%2C%22Value%22%3A%22Microsoft.Xrm.Sdk.Entity%5B%5D%22%7D%2C%7B%22Name%22%3A%22to%22%2C%22Value%22%3A%22Microsoft.Xrm.Sdk.Entity%5B%5D%22%7D%2C%7B%22Name%22%3A%22cc%22%2C%22Value%22%3A%22Microsoft.Xrm.Sdk.Entity%5B%5D%22%7D%2C%7B%22Name%22%3A%22regardingobjectid%22%2C%22Value%22%3A%22foobar%22%7D%2C%7B%22Name%22%3A%22isworkflowcreated%22%2C%22Value%22%3A%22False%22%7D%2C%7B%22Name%22%3A%22notifications%22%2C%22Value%22%3A%220%22%7D%2C%7B%22Name%22%3A%22followemailuserpreference%22%2C%22Value%22%3A%22False%22%7D%2C%7B%22Name%22%3A%22readreceiptrequested%22%2C%22Value%22%3A%22False%22%7D%2C%7B%22Name%22%3A%22foobar%22%2C%22Value%22%3A%22False%22%7D%2C%7B%22Name%22%3A%22emailreminderstatus%22%2C%22Value%22%3A%220%22%7D%2C%7B%22Name%22%3A%22isemailfollowed%22%2C%22Value%22%3A%22False%22%7D%2C%7B%22Name%22%3A%22emailremindertype%22%2C%22Value%22%3A%220%22%7D%2C%7B%22Name%22%3A%22isregularactivity%22%2C%22Value%22%3A%22False%22%7D%2C%7B%22Name%22%3A%22deliveryreceiptrequested%22%2C%22Value%22%3A%22False%22%7D%2C%7B%22Name%22%3A%22deliveryprioritycode%22%2C%22Value%22%3A%221%22%7D%2C%7B%22Name%22%3A%22isemailreminderset%22%2C%22Value%22%3A%22False%22%7D%2C%7B%22Name%22%3A%22compressed%22%2C%22Value%22%3A%22False%22%7D%2C%7B%22Name%22%3A%22prioritycode%22%2C%22Value%22%3A%221%22%7D%2C%7B%22Name%22%3A%22directioncode%22%2C%22Value%22%3A%22True%22%7D%2C%7B%22Name%22%3A%22correlationmethod%22%2C%22Value%22%3A%220%22%7D%2C%7B%22Name%22%3A%22activityid%22%2C%22Value%22%3A%22foobar%22%7D%5D%2C%22InstanceUrl%22%3A%22https%3A%5C%2F%5C%2Ffoobar.crm4.dynamics.com%5C%2F%22%2C%22ItemType%22%3A%22Dynamics365%22%2C%22ItemUrl%22%3A%22https%3A%5C%2F%5C%2Ffoobar.crm4.dynamics.com%5C%2Fmain.aspx%3Fetn%3Demail%26amp%3Bpagetype%3Dentityrecord%26amp%3Bid%3Dfoobar%22%2C%22UserAgent%22%3A%22%22%2C%22CorrelationId%22%3A%2200000000-0000-0000-0000-000000000000%22%2C%22EntityId%22%3A%22foobar%22%2C%22EntityName%22%3A%22email%22%2C%22Message%22%3A%22Create%22%2C%22PrimaryFieldValue%22%3A%22%22%2C%22Query%22%3A%22%22%2C%22QueryResults%22%3A%22%22%2C%22ServiceContextId%22%3A%2200000000-0000-0000-0000-000000000000%22%2C%22ServiceContextIdType%22%3A%22%22%2C%22ServiceName%22%3A%22Dynamics365%22%2C%22SystemUserId%22%3A%22foobar%22%2C%22UserUp%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-285835%22%20slang%3D%22en-US%22%3ERe%3A%20Incomplete%20data%20from%20Search-UnifiedAuditLog%20cmdlet%20for%20AzureAD%20record%20type%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-285835%22%20slang%3D%22en-US%22%3E%3CP%3EPlease%20find%20the%20sample%20below.%20I%20have%20replaced%20some%20values%20with%20an%20place-holder%20(%22foobar%22)%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%7B%22CreationTime%22%3A%222018-11-10T20%3A00%3A14%22%2C%22Id%22%3A%22foobar%22%2C%22Operation%22%3A%22CrmDefaultActivity%22%2C%22OrganizationId%22%3A%22foobar%22%2C%22RecordType%22%3A21%2C%22ResultStatus%22%3A%22Success%22%2C%22UserKey%22%3A%22Unknown%22%2C%22UserType%22%3A2%2C%22Version%22%3A1%2C%22Workload%22%3A%22CRM%22%2C%22ClientIP%22%3A%22127.0.0.1%22%2C%22ObjectId%22%3A%22Create%20email%22%2C%22UserId%22%3A%22drt%40alfapeople.com%22%2C%22CrmOrganizationUniqueName%22%3A%22foobar%22%2C%22Fields%22%3A%5B%7B%22Name%22%3A%22subject%22%2C%22Value%22%3A%22foobar%22%7D%2C%7B%22Name%22%3A%22description%22%2C%22Value%22%3A%22foobar%22%7D%2C%7B%22Name%22%3A%22ownerid%22%2C%22Value%22%3A%22foobar%22%7D%2C%7B%22Name%22%3A%22from%22%2C%22Value%22%3A%22Microsoft.Xrm.Sdk.Entity%5B%5D%22%7D%2C%7B%22Name%22%3A%22to%22%2C%22Value%22%3A%22Microsoft.Xrm.Sdk.Entity%5B%5D%22%7D%2C%7B%22Name%22%3A%22cc%22%2C%22Value%22%3A%22Microsoft.Xrm.Sdk.Entity%5B%5D%22%7D%2C%7B%22Name%22%3A%22regardingobjectid%22%2C%22Value%22%3A%22foobar%22%7D%2C%7B%22Name%22%3A%22isworkflowcreated%22%2C%22Value%22%3A%22False%22%7D%2C%7B%22Name%22%3A%22notifications%22%2C%22Value%22%3A%220%22%7D%2C%7B%22Name%22%3A%22followemailuserpreference%22%2C%22Value%22%3A%22False%22%7D%2C%7B%22Name%22%3A%22readreceiptrequested%22%2C%22Value%22%3A%22False%22%7D%2C%7B%22Name%22%3A%22foobar%22%2C%22Value%22%3A%22False%22%7D%2C%7B%22Name%22%3A%22emailreminderstatus%22%2C%22Value%22%3A%220%22%7D%2C%7B%22Name%22%3A%22isemailfollowed%22%2C%22Value%22%3A%22False%22%7D%2C%7B%22Name%22%3A%22emailremindertype%22%2C%22Value%22%3A%220%22%7D%2C%7B%22Name%22%3A%22isregularactivity%22%2C%22Value%22%3A%22False%22%7D%2C%7B%22Name%22%3A%22deliveryreceiptrequested%22%2C%22Value%22%3A%22False%22%7D%2C%7B%22Name%22%3A%22deliveryprioritycode%22%2C%22Value%22%3A%221%22%7D%2C%7B%22Name%22%3A%22isemailreminderset%22%2C%22Value%22%3A%22False%22%7D%2C%7B%22Name%22%3A%22compressed%22%2C%22Value%22%3A%22False%22%7D%2C%7B%22Name%22%3A%22prioritycode%22%2C%22Value%22%3A%221%22%7D%2C%7B%22Name%22%3A%22directioncode%22%2C%22Value%22%3A%22True%22%7D%2C%7B%22Name%22%3A%22correlationmethod%22%2C%22Value%22%3A%220%22%7D%2C%7B%22Name%22%3A%22activityid%22%2C%22Value%22%3A%22foobar%22%7D%5D%2C%22InstanceUrl%22%3A%22https%3A%5C%2F%5C%2Ffoobar.crm4.dynamics.com%5C%2F%22%2C%22ItemType%22%3A%22Dynamics365%22%2C%22ItemUrl%22%3A%22https%3A%5C%2F%5C%2Ffoobar.crm4.dynamics.com%5C%2Fmain.aspx%3Fetn%3Demail%26amp%3Bpagetype%3Dentityrecord%26amp%3Bid%3Dfoobar%22%2C%22UserAgent%22%3A%22%22%2C%22CorrelationId%22%3A%2200000000-0000-0000-0000-000000000000%22%2C%22EntityId%22%3A%22foobar%22%2C%22EntityName%22%3A%22email%22%2C%22Message%22%3A%22Create%22%2C%22PrimaryFieldValue%22%3A%22%22%2C%22Query%22%3A%22%22%2C%22QueryResults%22%3A%22%22%2C%22ServiceContextId%22%3A%2200000000-0000-0000-0000-000000000000%22%2C%22ServiceContextIdType%22%3A%22%22%2C%22ServiceName%22%3A%22Dynamics365%22%2C%22SystemUserId%22%3A%22foobar%22%2C%22UserUp%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-285787%22%20slang%3D%22en-US%22%3ERe%3A%20Incomplete%20data%20from%20Search-UnifiedAuditLog%20cmdlet%20for%20AzureAD%20record%20type%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-285787%22%20slang%3D%22en-US%22%3E%3CP%3EI%20have%20modified%20the%20following%20sample%20(e.g.%20%22CrmOrganizationUniqueName%22%20was%20replaced%20with%20an%20dummy%20value%20and%20all%20GUID%20values%20have%20been%20replaced%20with%20%22foobar%22)%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%7B%22CreationTime%22%3A%222018-11-10T20%3A00%3A14%22%2C%22Id%22%3A%22foobar%22%2C%22Operation%22%3A%22CrmDefaultActivity%22%2C%22OrganizationId%22%3A%22foobar%22%2C%22RecordType%22%3A21%2C%22ResultStatus%22%3A%22Success%22%2C%22UserKey%22%3A%22Unknown%22%2C%22UserType%22%3A2%2C%22Version%22%3A1%2C%22Workload%22%3A%22CRM%22%2C%22ClientIP%22%3A%22127.0.0.1%22%2C%22ObjectId%22%3A%22Create%20email%22%2C%22UserId%22%3A%22drt%40alfapeople.com%22%2C%22CrmOrganizationUniqueName%22%3A%22foobar%22%2C%22Fields%22%3A%5B%7B%22Name%22%3A%22subject%22%2C%22Value%22%3A%22foobar%22%7D%2C%7B%22Name%22%3A%22description%22%2C%22Value%22%3A%22foobar%22%7D%2C%7B%22Name%22%3A%22ownerid%22%2C%22Value%22%3A%22foobar%22%7D%2C%7B%22Name%22%3A%22from%22%2C%22Value%22%3A%22Microsoft.Xrm.Sdk.Entity%5B%5D%22%7D%2C%7B%22Name%22%3A%22to%22%2C%22Value%22%3A%22Microsoft.Xrm.Sdk.Entity%5B%5D%22%7D%2C%7B%22Name%22%3A%22cc%22%2C%22Value%22%3A%22Microsoft.Xrm.Sdk.Entity%5B%5D%22%7D%2C%7B%22Name%22%3A%22regardingobjectid%22%2C%22Value%22%3A%22foobar%22%7D%2C%7B%22Name%22%3A%22isworkflowcreated%22%2C%22Value%22%3A%22False%22%7D%2C%7B%22Name%22%3A%22notifications%22%2C%22Value%22%3A%220%22%7D%2C%7B%22Name%22%3A%22followemailuserpreference%22%2C%22Value%22%3A%22False%22%7D%2C%7B%22Name%22%3A%22readreceiptrequested%22%2C%22Value%22%3A%22False%22%7D%2C%7B%22Name%22%3A%22foobar%22%2C%22Value%22%3A%22False%22%7D%2C%7B%22Name%22%3A%22emailreminderstatus%22%2C%22Value%22%3A%220%22%7D%2C%7B%22Name%22%3A%22isemailfollowed%22%2C%22Value%22%3A%22False%22%7D%2C%7B%22Name%22%3A%22emailremindertype%22%2C%22Value%22%3A%220%22%7D%2C%7B%22Name%22%3A%22isregularactivity%22%2C%22Value%22%3A%22False%22%7D%2C%7B%22Name%22%3A%22deliveryreceiptrequested%22%2C%22Value%22%3A%22False%22%7D%2C%7B%22Name%22%3A%22deliveryprioritycode%22%2C%22Value%22%3A%221%22%7D%2C%7B%22Name%22%3A%22isemailreminderset%22%2C%22Value%22%3A%22False%22%7D%2C%7B%22Name%22%3A%22compressed%22%2C%22Value%22%3A%22False%22%7D%2C%7B%22Name%22%3A%22prioritycode%22%2C%22Value%22%3A%221%22%7D%2C%7B%22Name%22%3A%22directioncode%22%2C%22Value%22%3A%22True%22%7D%2C%7B%22Name%22%3A%22correlationmethod%22%2C%22Value%22%3A%220%22%7D%2C%7B%22Name%22%3A%22activityid%22%2C%22Value%22%3A%22foobar%22%7D%5D%2C%22InstanceUrl%22%3A%22https%3A%5C%2F%5C%2Ffoobar.crm4.dynamics.com%5C%2F%22%2C%22ItemType%22%3A%22Dynamics365%22%2C%22ItemUrl%22%3A%22https%3A%5C%2F%5C%2Ffoobar.crm4.dynamics.com%5C%2Fmain.aspx%3Fetn%3Demail%26amp%3Bpagetype%3Dentityrecord%26amp%3Bid%3Dfoobar%22%2C%22UserAgent%22%3A%22%22%2C%22CorrelationId%22%3A%2200000000-0000-0000-0000-000000000000%22%2C%22EntityId%22%3A%22foobar%22%2C%22EntityName%22%3A%22email%22%2C%22Message%22%3A%22Create%22%2C%22PrimaryFieldValue%22%3A%22%22%2C%22Query%22%3A%22%22%2C%22QueryResults%22%3A%22%22%2C%22ServiceContextId%22%3A%2200000000-0000-0000-0000-000000000000%22%2C%22ServiceContextIdType%22%3A%22%22%2C%22ServiceName%22%3A%22Dynamics365%22%2C%22SystemUserId%22%3A%22foobar%22%2C%22UserUp%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-285295%22%20slang%3D%22en-US%22%3ERe%3A%20Incomplete%20data%20from%20Search-UnifiedAuditLog%20cmdlet%20for%20AzureAD%20record%20type%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-285295%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EI%20don't%20run%20the%20CRM%20workload...%20could%20you%20post%20an%20example%20here%20of%20a%20truncated%20record%20so%20that%20I%20can%20make%20sure%20that%20this%20workload%20is%20fixed%20in%20the%20work%20that's%20ongoing%3F%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ETR%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-285230%22%20slang%3D%22en-US%22%3ERe%3A%20Incomplete%20data%20from%20Search-UnifiedAuditLog%20cmdlet%20for%20AzureAD%20record%20type%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-285230%22%20slang%3D%22en-US%22%3E%3CP%3EThe%20same%20problem%20is%20reproduceable%20for%20workload%20%22CRM%22.%20Hopefully%20is%20Microsoft%20able%20to%20address%20this%20issue%20soon.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-279278%22%20slang%3D%22en-US%22%3ERe%3A%20Incomplete%20data%20from%20Search-UnifiedAuditLog%20cmdlet%20for%20AzureAD%20record%20type%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-279278%22%20slang%3D%22en-US%22%3E%3CP%3EIs%20that%20%22soon%22%20or%20%22Microsoft%20soon%E2%84%A2%22%3F%20They%20sure%20are%20taking%20their%20sweet%20time%20with%20this...%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-279116%22%20slang%3D%22en-US%22%3ERe%3A%20Incomplete%20data%20from%20Search-UnifiedAuditLog%20cmdlet%20for%20AzureAD%20record%20type%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-279116%22%20slang%3D%22en-US%22%3E%3CP%3EAs%20I%20said%2C%20the%20truncation%20issue%20is%20being%20worked%20and%20we%20should%20have%20a%20solution%20soon.%20I%20am%20actively%20tracking%20the%20issue%20with%20engineering.%20See%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Foffice365foritpros.com%2F2018%2F10%2F22%2Flonger-retention-office365-auditdata%2F%26nbsp%3B%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Foffice365foritpros.com%2F2018%2F10%2F22%2Flonger-retention-office365-auditdata%2F%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-279112%22%20slang%3D%22en-US%22%3ERe%3A%20Incomplete%20data%20from%20Search-UnifiedAuditLog%20cmdlet%20for%20AzureAD%20record%20type%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-279112%22%20slang%3D%22en-US%22%3E%3CP%3EGreat%20-%20at%20the%20end%20of%20the%20day%20I%20am%20hoping%20for%20a%20valid%20JSON%20output.%26nbsp%3B%20If%20individual%20fields%20have%20to%20be%20thrown%20away%2Ftruncated%2C%20so%20be%20it.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-278945%22%20slang%3D%22en-US%22%3ERe%3A%20Incomplete%20data%20from%20Search-UnifiedAuditLog%20cmdlet%20for%20AzureAD%20record%20type%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-278945%22%20slang%3D%22en-US%22%3EThe%20problem%20is%20not%20the%20documented%20character%20limit.%20It%20is%20an%20ingestion%20problem%20for%20specific%20events%20that%20causes%20the%20JSON%20payload%20to%20be%20truncated%20as%20the%20record%20is%20written.%20Engineering%20is%20working%20on%20the%20issue.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-278933%22%20slang%3D%22en-US%22%3ERe%3A%20Incomplete%20data%20from%20Search-UnifiedAuditLog%20cmdlet%20for%20AzureAD%20record%20type%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-278933%22%20slang%3D%22en-US%22%3E%3CP%3Efrom%20the%20docs%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Foffice365%2Fsecuritycompliance%2Fsearch-the-audit-log-in-security-and-compliance%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Foffice365%2Fsecuritycompliance%2Fsearch-the-audit-log-in-security-and-compliance%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EThere's%20a%203%2C060-character%20limit%20for%20the%20data%20that's%20displayed%20in%20the%26nbsp%3B%3C%2FSPAN%3E%3CSTRONG%3EAuditData%3C%2FSTRONG%3E%3CSPAN%3E%26nbsp%3Bfield%20for%20an%20audit%20record.%20If%20the%203%2C060-character%20limit%20is%20exceeded%2C%20the%20data%20in%20this%20field%20is%20truncated.%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-260239%22%20slang%3D%22en-US%22%3ERe%3A%20Incomplete%20data%20from%20Search-UnifiedAuditLog%20cmdlet%20for%20AzureAD%20record%20type%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-260239%22%20slang%3D%22en-US%22%3E%3CP%3EI'm%20still%20discussing%20the%20issue.%20Microsoft%20has%20accepted%20that%20a%20problem%20exists%20and%20they%20need%20to%20fix%20it.%20Stay%20tuned.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-260236%22%20slang%3D%22en-US%22%3ERe%3A%20Incomplete%20data%20from%20Search-UnifiedAuditLog%20cmdlet%20for%20AzureAD%20record%20type%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-260236%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F64%22%20target%3D%22_blank%22%3E%40Tony%20Redmond%3C%2FA%3E%20was%20chasing%20this%20up%20with%20some%20MS%20folks%2C%20perhaps%20he%20can%20share%20some%20info.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-260232%22%20slang%3D%22en-US%22%3ERe%3A%20Incomplete%20data%20from%20Search-UnifiedAuditLog%20cmdlet%20for%20AzureAD%20record%20type%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-260232%22%20slang%3D%22en-US%22%3E%3CP%3EI'm%20curious%2C%20what%20character%20length%20is%20it%20truncating%20at%3F%20I%20believe%20I%20am%20seeing%20something%20similar%20for%20which%20I%20posted%20a%20question%20for%20on%20github.%20To%20me%20it%20looked%20like%20it%20the%20JSON%20string%20was%20getting%20truncated%20at%203062%20characters.%20If%20I%20get%20an%20answer%20there%20I%20will%20try%20and%20reply%20here%20as%20well!%20Link%20to%20the%20issue%20I%20created%20on%20github%3A%20%3CA%20href%3D%22https%3A%2F%2Fgithub.com%2FMicrosoftDocs%2Foffice-docs-powershell%2Fissues%2F1733%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fgithub.com%2FMicrosoftDocs%2Foffice-docs-powershell%2Fissues%2F1733%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-241138%22%20slang%3D%22en-US%22%3ERe%3A%20Incomplete%20data%20from%20Search-UnifiedAuditLog%20cmdlet%20for%20AzureAD%20record%20type%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-241138%22%20slang%3D%22en-US%22%3E%3CP%3EAs%20a%20workaround%2C%20you%20might%20be%20able%20to%20get%20the%20full%20event%20details%20from%20the%20Azure%20AD%20blade%20in%20the%20Azure%20portal.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-241136%22%20slang%3D%22en-US%22%3ERe%3A%20Incomplete%20data%20from%20Search-UnifiedAuditLog%20cmdlet%20for%20AzureAD%20record%20type%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-241136%22%20slang%3D%22en-US%22%3E%3CP%3EConfirmed%2C%20I%20see%20the%20same.%20What's%20even%20worse%2C%20if%20you%20use%20the%20UI%2C%20you%20get%20a%20%22Failure%3A%20Record%20truncated%22%20error.%20I'm%20not%20sure%20how%20this%20made%20it%20to%20production%2C%20but%20it%20should%20be%20addressed%20ASAP.%20Open%20a%20support%20case.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-682144%22%20slang%3D%22en-US%22%3ERe%3A%20Incomplete%20data%20from%20Search-UnifiedAuditLog%20cmdlet%20for%20AzureAD%20record%20type%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-682144%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSPAN%3E7%20months%20passed.%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%3EThe%20problem%20still%20exists.%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3ENow%2C%20I%20think%2C%20maybe%2C%20this%20is%20not%20a%20bug%2C%20but%20a%20feature.%26nbsp%3B%20%3A)%3C%2Fimg%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Occasional Contributor

Hi,

 

From the below cmdlet I got AuditData parameter as an incomplete JSON string.

Search-UnifiedAuditLog -Operations 'Update User.' -RecordType azureactivedirectory -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date)

I attached the output which i got.

 

AuditData.PNG

Please help me with this case !!! 

 

21 Replies
Highlighted

Confirmed, I see the same. What's even worse, if you use the UI, you get a "Failure: Record truncated" error. I'm not sure how this made it to production, but it should be addressed ASAP. Open a support case.

Highlighted

As a workaround, you might be able to get the full event details from the Azure AD blade in the Azure portal.

Highlighted

I'm curious, what character length is it truncating at? I believe I am seeing something similar for which I posted a question for on github. To me it looked like it the JSON string was getting truncated at 3062 characters. If I get an answer there I will try and reply here as well! Link to the issue I created on github: https://github.com/MicrosoftDocs/office-docs-powershell/issues/1733

Highlighted

@Tony Redmond was chasing this up with some MS folks, perhaps he can share some info.

Highlighted

I'm still discussing the issue. Microsoft has accepted that a problem exists and they need to fix it. Stay tuned.

Highlighted

from the docs https://docs.microsoft.com/en-us/office365/securitycompliance/search-the-audit-log-in-security-and-c...

 

There's a 3,060-character limit for the data that's displayed in the AuditData field for an audit record. If the 3,060-character limit is exceeded, the data in this field is truncated.

Highlighted
The problem is not the documented character limit. It is an ingestion problem for specific events that causes the JSON payload to be truncated as the record is written. Engineering is working on the issue.
Highlighted

Great - at the end of the day I am hoping for a valid JSON output.  If individual fields have to be thrown away/truncated, so be it.

Highlighted

As I said, the truncation issue is being worked and we should have a solution soon. I am actively tracking the issue with engineering. See https://office365foritpros.com/2018/10/22/longer-retention-office365-auditdata/ 

Highlighted

Is that "soon" or "Microsoft soon™"? They sure are taking their sweet time with this...

Highlighted

The same problem is reproduceable for workload "CRM". Hopefully is Microsoft able to address this issue soon.

Highlighted

Hi,

 

I don't run the CRM workload... could you post an example here of a truncated record so that I can make sure that this workload is fixed in the work that's ongoing?

 

TR

Highlighted

I have modified the following sample (e.g. "CrmOrganizationUniqueName" was replaced with an dummy value and all GUID values have been replaced with "foobar")

 

 

{"CreationTime":"2018-11-10T20:00:14","Id":"foobar","Operation":"CrmDefaultActivity","OrganizationId":"foobar","RecordType":21,"ResultStatus":"Success","UserKey":"Unknown","UserType":2,"Version":1,"Workload":"CRM","ClientIP":"127.0.0.1","ObjectId":"Create email","UserId":"drt@alfapeople.com","CrmOrganizationUniqueName":"foobar","Fields":[{"Name":"subject","Value":"foobar"},{"Name":"description","Value":"foobar"},{"Name":"ownerid","Value":"foobar"},{"Name":"from","Value":"Microsoft.Xrm.Sdk.Entity[]"},{"Name":"to","Value":"Microsoft.Xrm.Sdk.Entity[]"},{"Name":"cc","Value":"Microsoft.Xrm.Sdk.Entity[]"},{"Name":"regardingobjectid","Value":"foobar"},{"Name":"isworkflowcreated","Value":"False"},{"Name":"notifications","Value":"0"},{"Name":"followemailuserpreference","Value":"False"},{"Name":"readreceiptrequested","Value":"False"},{"Name":"foobar","Value":"False"},{"Name":"emailreminderstatus","Value":"0"},{"Name":"isemailfollowed","Value":"False"},{"Name":"emailremindertype","Value":"0"},{"Name":"isregularactivity","Value":"False"},{"Name":"deliveryreceiptrequested","Value":"False"},{"Name":"deliveryprioritycode","Value":"1"},{"Name":"isemailreminderset","Value":"False"},{"Name":"compressed","Value":"False"},{"Name":"prioritycode","Value":"1"},{"Name":"directioncode","Value":"True"},{"Name":"correlationmethod","Value":"0"},{"Name":"activityid","Value":"foobar"}],"InstanceUrl":"https:\/\/foobar.crm4.dynamics.com\/","ItemType":"Dynamics365","ItemUrl":"https:\/\/foobar.crm4.dynamics.com\/main.aspx?etn=email&pagetype=entityrecord&id=foobar","UserAgent":"","CorrelationId":"00000000-0000-0000-0000-000000000000","EntityId":"foobar","EntityName":"email","Message":"Create","PrimaryFieldValue":"","Query":"","QueryResults":"","ServiceContextId":"00000000-0000-0000-0000-000000000000","ServiceContextIdType":"","ServiceName":"Dynamics365","SystemUserId":"foobar","UserUp

Highlighted

Please find the sample below. I have replaced some values with an place-holder ("foobar")

 

{"CreationTime":"2018-11-10T20:00:14","Id":"foobar","Operation":"CrmDefaultActivity","OrganizationId":"foobar","RecordType":21,"ResultStatus":"Success","UserKey":"Unknown","UserType":2,"Version":1,"Workload":"CRM","ClientIP":"127.0.0.1","ObjectId":"Create email","UserId":"drt@alfapeople.com","CrmOrganizationUniqueName":"foobar","Fields":[{"Name":"subject","Value":"foobar"},{"Name":"description","Value":"foobar"},{"Name":"ownerid","Value":"foobar"},{"Name":"from","Value":"Microsoft.Xrm.Sdk.Entity[]"},{"Name":"to","Value":"Microsoft.Xrm.Sdk.Entity[]"},{"Name":"cc","Value":"Microsoft.Xrm.Sdk.Entity[]"},{"Name":"regardingobjectid","Value":"foobar"},{"Name":"isworkflowcreated","Value":"False"},{"Name":"notifications","Value":"0"},{"Name":"followemailuserpreference","Value":"False"},{"Name":"readreceiptrequested","Value":"False"},{"Name":"foobar","Value":"False"},{"Name":"emailreminderstatus","Value":"0"},{"Name":"isemailfollowed","Value":"False"},{"Name":"emailremindertype","Value":"0"},{"Name":"isregularactivity","Value":"False"},{"Name":"deliveryreceiptrequested","Value":"False"},{"Name":"deliveryprioritycode","Value":"1"},{"Name":"isemailreminderset","Value":"False"},{"Name":"compressed","Value":"False"},{"Name":"prioritycode","Value":"1"},{"Name":"directioncode","Value":"True"},{"Name":"correlationmethod","Value":"0"},{"Name":"activityid","Value":"foobar"}],"InstanceUrl":"https:\/\/foobar.crm4.dynamics.com\/","ItemType":"Dynamics365","ItemUrl":"https:\/\/foobar.crm4.dynamics.com\/main.aspx?etn=email&pagetype=entityrecord&id=foobar","UserAgent":"","CorrelationId":"00000000-0000-0000-0000-000000000000","EntityId":"foobar","EntityName":"email","Message":"Create","PrimaryFieldValue":"","Query":"","QueryResults":"","ServiceContextId":"00000000-0000-0000-0000-000000000000","ServiceContextIdType":"","ServiceName":"Dynamics365","SystemUserId":"foobar","UserUp

Highlighted

Please find attached an sample of the audit log (value of "AuditData"), i have replaced some values with an place-holder ("foobar")

 

 

{"CreationTime":"2018-11-10T20:00:14","Id":"foobar","Operation":"CrmDefaultActivity","OrganizationId":"foobar","RecordType":21,"ResultStatus":"Success","UserKey":"Unknown","UserType":2,"Version":1,"Workload":"CRM","ClientIP":"127.0.0.1","ObjectId":"Create email","UserId":"drt@alfapeople.com","CrmOrganizationUniqueName":"foobar","Fields":[{"Name":"subject","Value":"foobar"},{"Name":"description","Value":"foobar"},{"Name":"ownerid","Value":"foobar"},{"Name":"from","Value":"Microsoft.Xrm.Sdk.Entity[]"},{"Name":"to","Value":"Microsoft.Xrm.Sdk.Entity[]"},{"Name":"cc","Value":"Microsoft.Xrm.Sdk.Entity[]"},{"Name":"regardingobjectid","Value":"foobar"},{"Name":"isworkflowcreated","Value":"False"},{"Name":"notifications","Value":"0"},{"Name":"followemailuserpreference","Value":"False"},{"Name":"readreceiptrequested","Value":"False"},{"Name":"foobar","Value":"False"},{"Name":"emailreminderstatus","Value":"0"},{"Name":"isemailfollowed","Value":"False"},{"Name":"emailremindertype","Value":"0"},{"Name":"isregularactivity","Value":"False"},{"Name":"deliveryreceiptrequested","Value":"False"},{"Name":"deliveryprioritycode","Value":"1"},{"Name":"isemailreminderset","Value":"False"},{"Name":"compressed","Value":"False"},{"Name":"prioritycode","Value":"1"},{"Name":"directioncode","Value":"True"},{"Name":"correlationmethod","Value":"0"},{"Name":"activityid","Value":"foobar"}],"InstanceUrl":"https:\/\/foobar.crm4.dynamics.com\/","ItemType":"Dynamics365","ItemUrl":"https:\/\/foobar.crm4.dynamics.com\/main.aspx?etn=email&pagetype=entityrecord&id=foobar","UserAgent":"","CorrelationId":"00000000-0000-0000-0000-000000000000","EntityId":"foobar","EntityName":"email","Message":"Create","PrimaryFieldValue":"","Query":"","QueryResults":"","ServiceContextId":"00000000-0000-0000-0000-000000000000","ServiceContextIdType":"","ServiceName":"Dynamics365","SystemUserId":"foobar","UserUp

 

Highlighted

Dear all,

Any news for that question ?

I tried to use the Web interface to export the data and discovered that AuditData field limitation truncated to 3000 chars
I created a dedicated PowerShell script using the special command:

 - Search-UnifiedAuditLog

 

And found the truncate is also done at this Powershell level, so when that issue will be fixed ?

 

Thanks for your feedback.

 

PS: 

I posted a script to manage that AuditLog:

 - https://techcommunity.microsoft.com/t5/Office-365/PowerShell-script-to-export-Audit-log-search-Data-...

The limitation still exist with the PS command

 

Fab

Highlighted

The problem still exists.

 

Microsoft applied an update to the code and the result is even worse than before. The audit records for Azure AD group operations now contain a lot of detail, but the audit data is badly terminated. The net result is that these events don't show up in the SCC.

 

Messages have been sent to Microsoft to ask if they can look at the issue again. It's sad, but this has been a problem that started in August 2018...

 

TR

Highlighted

Oh the wonders of the DevOps world...

Highlighted

I imagined that you'd like the current state of affairs...