Forum Discussion
Audit log search error: "Fail to opt in, please refresh"
I spotted this curious little error today, anyone know what may be causing it? I'm trying to pull all user audit logs for a specific SPO site.
Microsoft have confirmed a fix has been deployed! See below from the Microsoft engineer -
Please be informed that the fix has been deployed to customers that are receiving the alarm "Fail to opt-in, please refresh" on the Audit log search page. This alarm "Fail to opt-in, please refresh" can be ignored, as the search is not currently affected.
The fix has been checked, but it may still need 3 more weeks to be deployed fully to all data center servers
- I keep seeing that message too. Even on other pages (Quarantine Review) in the portal. Sometimes a page refresh fixes it sometimes not. Don't know if we can trust the results that are returned or not returned when the message appears.
I think the MS services are just overwhelmed as I also get lots of "Requests are being Throttled" in the Azure mgmt portal even when I haven't searched for anything.I'm seeing exactly the same symptoms as Forrest_H. Sometimes it all works fine, sometimes I see these messages.
I opened a support ticket with Microsoft about this on Friday 18th Oct 2019.
I was given the following information from their health portal -
Issue: fail to opt in, please refresh.
Resolution:
•EX193067
Exchange Online - Can't get fresh audit log data
Impact Description
Admins are unable to obtain fresh audit log data from the Security and Compliance Center (SCC).
Latest Message
Title: Can't get fresh audit log data User Impact: Admins are unable to obtain fresh audit log data from the Security and Compliance Center (SCC). More info: Audit log data after Sunday, October 13, 2019, is not available in the SCC. Current status: We're continuing to monitor progress of the queues to ensure data after Sunday, October 13, 2019, is replicated to the SCC. The queues are currently draining as expected, and we anticipate drainage to potentially complete in 24 hours. Scope of impact: Your organization is affected by this event. Impact is specific to admins in your organization attempting to collect fresh audit log data in the SCC. Start time: Monday, October 14, 2019, at 1:00 AM UTC Root cause: A portion of infrastructure that stores data reached storage capacity, causing processing delays, resulting in impact. Next update by: Tuesday, October 15, 2019, at 8:00 PM UTC
I was then told to keep an eye on the health portal for further updates. Several days later and there have been no updates on the health portal and the issue is still occurring. I have reopened my support ticket with Microsoft and am awaiting a call back.
BenC187Thanks for that info.
I've been having this issue since at least Oct 13th. It seems it also impacts my ability to complete these audit-related tasks in the Microsoft Secure Score (not scoring these after I complete them). This has also been an issue since roughly the 13th.
If it has been more than 24h since you toggled the audit log collection, open a support case.
