How to get list of licenses assigned in Office 365 from Audit logs back to April 2020

Question

Looking for how to get more detailed Office 365 Audit Log data for
licenses. My goal is to generate a report that shows which user got
assigned which O365 license on which day, and same info in the case of a
license change

I run an audit report choosing the 2 license options: set liscense
properties, changed user license

I get 174 results, exported to CSV and viewing in portal, I can see that
user X had a license assigned or changed on day Y. So far so good, but
what I can't find is what specific license is being referenced. Customer
has a mix of E3, EoLP2, Project, and Visio

Is there any way to get this data or extract if from the large amounts of
content it shows with id's and guid's and such in the output data?

This seems to suggest I can pull this data from Azure Audit logs, but it's
not letting me select anything more than 7 days old whereas I am getting
Audit data back to Apr 2020 from the O365 Compliance center

concept-audit-logs

And my goal is to pull the specific licenses assigned to each user going
back to April 2020.

Answer 1

There were some issues around "too large" data being returned in such events, and it looks like MS decided to just drop the entire thing. Neither the Azure AD audit log, the Unified audit log within O365 or MCAS will show the actual SKU and what changed... which kind of makes these events useless. I'll try to get some more info on this and circle back.

Answer 2

I can see the details now, for new licensing events at least. It also turns out that few licensing flows, including group-based licensing, didnt even generate events. All started magically working after making some fuzz, go figure.

Answer 3

Well that is decidedly disappointing.

Thanks look forward to anything you can find. As I think about it now, I remember the issue with "too large" data being returned a few years ago, just never thought it would tie in with this kind of info. I wonder what MS does on the backend if they get a subpoena for this type of data for a tenant.

The data must be accessible somewhere....

Answer 4

Wait a second, are you saying that rerunning my O365 Audit log queries again should now show me the missing data I am looking for?

If that's the case I'll be ecstatic when I get back to the computer tomorrow.

Answer 5

Had to take a look, doesn't appear any better, use search queries in the web gui and while the number of records seems about the same, the actual detailed content appears to be less. I then scope to a new user added in early March and I get zero results on a license query.