Share via

O365 managment api sync new audit logs and delayed events

Alberto Gonzalez 1 Reputation point
2021-02-08T07:36:25.023+00:00

Hi, we have an application that get o365 audit logs using activity managment api and keep them in local database. O365 api returns a list of blobs and each blobs contains a group of events.

Till now every time we run the app we kept track of last event timepstamp and next time we only get events from this time.

The problem is in 0365 many events get delayed and can come at a later time like 24 hours later in the current blob or in previous blobs of today, how can we find out a keep track of them?

I though blobs were like rotating logs that once a new blob is created all new events go there but is not like that as an event from last night can appear suddenly in the current blob today at 10 am or in a previously closed blob at 6am.

Can anyone explain how this work? how delayed events get places in blobs and what would be the right way to scan for new events not processed?

Office Management
Office Management
Office: A suite of Microsoft productivity software that supports common business tasks, including word processing, email, presentations, and data management and analysis.Management: The act or process of organizing, handling, directing or controlling something.
2,026 questions