Cannot enable auditing in Purview

Question

Cannot enable auditing in Purview

Anonymous

Hello

Please i need your help on this issue.

When attempting to turn on auditing in Purview, I met with the following message "Sorry, we're having trouble figuring out if activity is being recorded. Try refreshing the page.".

I have the Global Administrator role in the tenant.

Chandra Boorla 15,480 Reputation points Microsoft External Staff Moderator

2025-03-05T22:34:10.57+00:00

Hi @James James

Thank you for posting your query!

It looks like you're facing an issue when trying to enable auditing in Microsoft Purview. The error message "Sorry, we're having trouble figuring out if activity is being recorded. Try refreshing the page." indicates that Purview is having trouble confirming whether auditing can be enabled or if it's functioning as expected.

Here are a few things you can try to resolve the issue:

Service Issues - There might be a temporary issue with Microsoft Purview's service. You could try again after a short period or check the Azure status page to see if there's a known outage.

Refresh the Page or Clear Browser Cache - As suggested in the error message, refreshing the page or clearing your browser cache can sometimes resolve display issues. You can also try accessing the portal in an incognito window or using a different browser.

Check Service Health - Sometimes, the issue might be related to service disruptions. You can check the Azure Status page to see if there are any ongoing problems with Microsoft Purview.

Verify Permissions and Roles - While the Global Administrator role generally has the required permissions, some specific actions in Purview (like enabling auditing) may need additional roles such as Purview Data Curator or Purview Data Reader. Please ensure that you have the correct permissions for this task.

Review Activity Logs - Check the Azure Activity Logs to see if there are any entries related to enabling auditing in Purview. This might provide more insight into what's going wrong.

I hope this information helps. Please do let us know if you have any further queries.

Kindly consider upvoting the comment if the information provided is helpful. This can assist other community members in resolving similar issues.

Thank you.
Chandra Boorla 15,480 Reputation points Microsoft External Staff Moderator

2025-03-06T23:08:52.7066667+00:00

@James James

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Chandra Boorla 15,480 Reputation points Microsoft External Staff Moderator

2025-03-07T21:45:04.3633333+00:00

@James James

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Thank you.

2 answers

Your answer

Chandra Boorla 15,480 Reputation points Microsoft External Staff Moderator

2025-03-05T22:34:10.57+00:00

Hi @James James

Thank you for posting your query!

It looks like you're facing an issue when trying to enable auditing in Microsoft Purview. The error message "Sorry, we're having trouble figuring out if activity is being recorded. Try refreshing the page." indicates that Purview is having trouble confirming whether auditing can be enabled or if it's functioning as expected.

Here are a few things you can try to resolve the issue:

Service Issues - There might be a temporary issue with Microsoft Purview's service. You could try again after a short period or check the Azure status page to see if there's a known outage.

Refresh the Page or Clear Browser Cache - As suggested in the error message, refreshing the page or clearing your browser cache can sometimes resolve display issues. You can also try accessing the portal in an incognito window or using a different browser.

Check Service Health - Sometimes, the issue might be related to service disruptions. You can check the Azure Status page to see if there are any ongoing problems with Microsoft Purview.

Verify Permissions and Roles - While the Global Administrator role generally has the required permissions, some specific actions in Purview (like enabling auditing) may need additional roles such as Purview Data Curator or Purview Data Reader. Please ensure that you have the correct permissions for this task.

Review Activity Logs - Check the Azure Activity Logs to see if there are any entries related to enabling auditing in Purview. This might provide more insight into what's going wrong.

I hope this information helps. Please do let us know if you have any further queries.

Kindly consider upvoting the comment if the information provided is helpful. This can assist other community members in resolving similar issues.

Thank you.
Chandra Boorla 15,480 Reputation points Microsoft External Staff Moderator

2025-03-06T23:08:52.7066667+00:00

@James James

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Chandra Boorla 15,480 Reputation points Microsoft External Staff Moderator

2025-03-07T21:45:04.3633333+00:00

@James James

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Thank you.

Answer 1

Hello,

I had similar problem today. The the solution was to:

Used Exchange Online in Powershell as @Pauline Mbabu said.

But when I ran :

Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true

I got an error:

BadRequest: Error executing cmdlet : { "code": "BadRequest", "message": "Error executing cmdlet", "details": [ { "code": "Context", "target": "AdminAuditLogConfig", "message": "|Microsoft.Exchange.Configuration.Tasks.InvalidOperationInDehydratedContextException|The command you tried to run isn't currently al lowed in your organization. To run this command, you first need to run the command: Enable-OrganizationCustomization."

So then you run:

Enable-OrganizationCustomization.

Verify if it is ok with command below. It should say false:

Get-OrganizationConfig | FL IsDehydrated

Then you can use this commends to enable audit and verify. Can take up to 60min.

Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true
Get-AdminAuditLogConfig | FL UnifiedAuditLogIngestionEnabled

After you can refresh the UI at purview site. The notification should not be there anymore.

Answer 2

Hello @Anonymous ,

Kindly first start by confirming if the Audit Log is enabled. You can do so by running the command below in Exchange Online Powershell.*
Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled*
A value of True for the UnifiedAuditLogIngestionEnabled property indicates that auditing is turned on. A value of False indicates that auditing isn't turned on.

If Audit Log is not enabled then confirm that you can attempt to turn on using PowerShell by running the command below:
Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true

If the issue Persists, I recommend you open a Support Case at https://support.microsoft.com/en-us so that we can Investigate this issue Further.

Doc Ref: https://learn.microsoft.com/en-us/purview/audit-log-enable-disable?tabs=microsoft-purview-portal#use-powershell-to-turn-on-auditing

If you find the answer above helpful, please Accept the answer to help anyone in the community who might have a similar question to quickly find the solution.