Oct 17 2019 11:06 AM
Oct 17 2019 11:06 AM
I spotted this curious little error today, anyone know what may be causing it? I'm trying to pull all user audit logs for a specific SPO site.
Oct 17 2019 11:14 AM
Oct 17 2019 11:41 PM
If it has been more than 24h since you toggled the audit log collection, open a support case.
Oct 18 2019 01:34 AM
I'm seeing exactly the same symptoms as @Forrest Hoffman. Sometimes it all works fine, sometimes I see these messages.
Oct 22 2019 03:34 AM
I opened a support ticket with Microsoft about this on Friday 18th Oct 2019.
I was given the following information from their health portal -
Issue: fail to opt in, please refresh.
Exchange Online - Can't get fresh audit log data
Admins are unable to obtain fresh audit log data from the Security and Compliance Center (SCC).
Title: Can't get fresh audit log data User Impact: Admins are unable to obtain fresh audit log data from the Security and Compliance Center (SCC). More info: Audit log data after Sunday, October 13, 2019, is not available in the SCC. Current status: We're continuing to monitor progress of the queues to ensure data after Sunday, October 13, 2019, is replicated to the SCC. The queues are currently draining as expected, and we anticipate drainage to potentially complete in 24 hours. Scope of impact: Your organization is affected by this event. Impact is specific to admins in your organization attempting to collect fresh audit log data in the SCC. Start time: Monday, October 14, 2019, at 1:00 AM UTC Root cause: A portion of infrastructure that stores data reached storage capacity, causing processing delays, resulting in impact. Next update by: Tuesday, October 15, 2019, at 8:00 PM UTC
I was then told to keep an eye on the health portal for further updates. Several days later and there have been no updates on the health portal and the issue is still occurring. I have reopened my support ticket with Microsoft and am awaiting a call back.
Oct 25 2019 03:52 AM
I've logged this today as we're still getting the same message. MS asked me to try refreshing the page...
Oct 25 2019 08:45 AM
@BenC187Thanks for that info.
I've been having this issue since at least Oct 13th. It seems it also impacts my ability to complete these audit-related tasks in the Microsoft Secure Score (not scoring these after I complete them). This has also been an issue since roughly the 13th.
Oct 28 2019 03:03 AM
@REGHA1205 Have you received any further updates, I am seeing this message constantly and refresh has no effect,
Oct 28 2019 03:08 AM
If it's of any help to anyone, the message I received in responce to my ticket was:
Thanks for giving the workaround a short.
As pointed out in my previous email, there is a service degradation impacting Exchange Online audit log data search.(EX193067 and EX193722).
We sincerely apologize for any inconvenience this has caused you.
Please be assured this is currently been reviewed.
I will keep tabs on this and update you as soon as updates on this.
The Workaround mentioned was to connect to Exchange Online using PowerShell and run the Enable-OrganizationCustomization cmdlet. This was already enabled in our case.
Oct 28 2019 03:09 AM
Thanks ben, im having same issue and am trying some workaround to see if it fixes the issue.
i will update you soon@BenC187x
Oct 28 2019 03:29 AM
I have had a reply from microsoft, just as I suspected....
Please be informed that our engineers are working towards achieving a resolution to the issue, and admins will be able to manage Audit Log Search, once the fix reaches their respective environments.
Oct 29 2019 03:12 AMSolution
Microsoft have confirmed a fix has been deployed! See below from the Microsoft engineer -
Please be informed that the fix has been deployed to customers that are receiving the alarm "Fail to opt-in, please refresh" on the Audit log search page. This alarm "Fail to opt-in, please refresh" can be ignored, as the search is not currently affected.
The fix has been checked, but it may still need 3 more weeks to be deployed fully to all data center servers
Oct 29 2019 03:41 AM
@BenC187x did you take note of the tech response which said the message will still be displayed for a few weeks but should be ignored and has no impact on the search?
They didn't indicate that the compliance secure score would now properly recognise that the reports are being run though. would take a few days to see if that is the case I guess.
Oct 29 2019 03:54 AM