Audit Logs events without actor

Maksim Mikhailov 0

I get a lot of "failed" events in "Audit Logs" without "Initiated by (actor)".

These events have "Activity Type" as "Delete role definition" and "Status reason" as Microsoft.Online.Workflows.ObjectNotFoundException.

This is an example of one of them:

{"id":"Directory_438e484d-6da2-46ec-b2df-547def498ce1_GQZ53_193084516","category":"RoleManagement","correlationId":"438e484d-6da2-46ec-b2df-547def498ce1","result":"failure","resultReason":"Microsoft.Online.Workflows.ObjectNotFoundException","activityDisplayName":"Delete role definition","activityDateTime":"2023-06-26T14:49:56.7070703+00:00","loggedByService":"Core Directory","initiatedBy":{},"userAgent":null,"targetResources":[{"id":"7bdbaba8-c711-4315-834c-2d4de76c42b6","displayName":"AT_TEST","type":"Other","userPrincipalName":null,"groupType":null,"modifiedProperties":[{"displayName":"MethodExecutionResult.","oldValue":null,"newValue":"\"Microsoft.Online.Workflows.ObjectNotFoundException\""}]}],"additionalDetails":[]}

The other events are attached in the file "AuditLogs_2023-07-10".

What do these failed events mean?

Can there be valid events in Audit Log without "actor"?

What are these events?

Thanks.

Sandeep G-MSFT 20,376 Reputation points Microsoft Employee

2023-07-12T12:04:00.58+00:00

@Maksim Mikhailov

Thank you for posting this question in Microsoft Q&A.

I am looking into this issue. I will reproduce this issue and will get back to you on this.
Sandeep G-MSFT 20,376 Reputation points Microsoft Employee

2023-07-14T08:25:09.6366667+00:00

@Maksim Mikhailov

This error states that the role that user was trying to delete, doesn't exist in the directory. If some application tried to delete this role from the directory then the actor field would be blank.

I wanted to check if you see any other audit logs without actor, which is a success status.

Share via

Audit Logs events without actor

Your answer