Audit log search error: "Fail to opt in, please refresh"

[Niv Dolgin]

I spotted this curious little error today, anyone know what may be causing it? I'm trying to pull all user audit logs for a specific SPO site. 

[#2]

I keep seeing that message too. Even on other pages (Quarantine Review) in the portal. Sometimes a page refresh fixes it sometimes not. Don't know if we can trust the results that are returned or not returned when the message appears.
I think the MS services are just overwhelmed as I also get lots of "Requests are being Throttled" in the Azure mgmt portal even when I haven't searched for anything.

[#3]

If it has been more than 24h since you toggled the audit log collection, open a support case.

[#4]

I'm seeing exactly the same symptoms as @Forrest_H.  Sometimes it all works fine, sometimes I see these messages.

[#5]

@Niv Dolgin 

I opened a support ticket with Microsoft about this on Friday 18th Oct 2019.

I was given the following information from their health portal -

Issue:   fail to opt in, please refresh.

Resolution:

•EX193067

Exchange Online - Can't get fresh audit log data

Impact Description

Admins are unable to obtain fresh audit log data from the Security and Compliance Center (SCC).

Latest Message

Title: Can't get fresh audit log data User Impact: Admins are unable to obtain fresh audit log data from the Security and Compliance Center (SCC). More info: Audit log data after Sunday, October 13, 2019, is not available in the SCC. Current status: We're continuing to monitor progress of the queues to ensure data after Sunday, October 13, 2019, is replicated to the SCC. The queues are currently draining as expected, and we anticipate drainage to potentially complete in 24 hours. Scope of impact: Your organization is affected by this event. Impact is specific to admins in your organization attempting to collect fresh audit log data in the SCC. Start time: Monday, October 14, 2019, at 1:00 AM UTC Root cause: A portion of infrastructure that stores data reached storage capacity, causing processing delays, resulting in impact. Next update by: Tuesday, October 15, 2019, at 8:00 PM UTC

I was then told to keep an eye on the health portal for further updates. Several days later and there have been no updates on the health portal and the issue is still occurring. I have reopened my support ticket with Microsoft and am awaiting a call back.

[#6]

@BenC187 

I've logged this today as we're still getting the same message. MS asked me to try refreshing the page...

[#7]

@BenC187Thanks for that info.

I've been having this issue since at least Oct 13th.  It seems it also impacts my ability to complete these audit-related tasks in the Microsoft Secure Score (not scoring these after I complete them).  This has also been an issue since roughly the 13th.

[#8]

Hi, have you gotten any update from MS support engineer yet@BenC187 

[#9]

@REGHA1205 Have you received any further updates, I am seeing this message constantly and refresh has no effect,

[#10]

No further updates from Microsoft.

I will chase them again today.

[#11]

@BenC187x 

If it's of any help to anyone, the message I received in responce to my ticket was:

Thanks for giving the workaround a short.​

As pointed out in my previous email, there is a service degradation impacting Exchange Online audit log data search.(EX193067 and EX193722).​

We sincerely apologize for any inconvenience this has caused you.​

Please be assured this is currently been reviewed.​

I will keep tabs on this and update you as soon as updates on this.​

The Workaround mentioned was to connect to Exchange Online using PowerShell and run the Enable-OrganizationCustomization cmdlet. This was already enabled in our case.

[#12]

Thanks ben, im having same issue and am trying some workaround to see if it fixes the issue.

i will update you soon@BenC187x 

[#13]

I have had a reply from microsoft, just as I suspected....

Please be informed that our engineers are working towards achieving a resolution to the issue, and admins will be able to manage Audit Log Search, once the fix reaches their respective environments.

[#14]

Hmm intresting this issue has been pending for weeks.@BenC187x 

[#15]

@BenC187x  Helpful as ever. 

[#16 · Accepted solution]

Microsoft have confirmed a fix has been deployed! See below from the Microsoft engineer -

Please be informed that the fix has been deployed to customers that are receiving the alarm "Fail to opt-in, please refresh" on the Audit log search page. This alarm "Fail to opt-in, please refresh" can be ignored, as the search is not currently affected. 

The fix has been checked, but it may still need 3 more weeks to be deployed fully to all data center servers

[#17]

After testing it is still not working for me yet though.

[#18]

@BenC187x  did you take note of the tech response which said the message will still be displayed for a few weeks but should be ignored and has no impact on the search? 

They didn't indicate that the compliance secure score would now properly recognise that the reports are being run though.  would take a few days to see if that is the case I guess.

[#19]

Yes, I saw I still get the error show but the results are not displayed so will wait it out a bit longer.