Missing/Inaccurate Audit Logs and Sign-in Logs

Rat 1 Reputation point
2021-09-25T12:51:41.387+00:00

Hello,

I have a admin whose Sign-in logs & Audit logs (under Azure Monitoring) only appear for 5 of 22 users. All the users have a Exchange P1 license. Is there any explanation/troubleshooting as to why Audit and/or Sign-in logs would appear for some users and not others?

Troubleshooting steps taken:
-Removed all filters during the audit search
-Checked for compromised accounts
-Verified licenses
-Verified user activity within the last 30 days
-Attempted to reproduce the issue in my own tenant with the same license (Exchange P1). Audit logs and sign in logs populate accurate data.

I appreciate any feedback.

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
2,740 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,100 questions
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Vasil Michev 92,596 Reputation points MVP
    2021-09-26T10:43:38.917+00:00

    Best open a support case. Some audit/reporting features require Azure AD P1 licenses, but you should be able to see at least 30 days of data even for the "free" tier.

    0 comments No comments