question

HarondelJSibble-8504 avatar image
0 Votes"
HarondelJSibble-8504 asked HarondelJSibble-8504 answered

How to get list of licenses assigned in Office 365 from Audit logs back to April 2020

Looking for how to get more detailed Office 365 Audit Log data for
licenses. My goal is to generate a report that shows which user got
assigned which O365 license on which day, and same info in the case of a
license change

I run an audit report choosing the 2 license options: set liscense
properties, changed user license

I get 174 results, exported to CSV and viewing in portal, I can see that
user X had a license assigned or changed on day Y. So far so good, but
what I can't find is what specific license is being referenced. Customer
has a mix of E3, EoLP2, Project, and Visio

Is there any way to get this data or extract if from the large amounts of
content it shows with id's and guid's and such in the output data?

This seems to suggest I can pull this data from Azure Audit logs, but it's
not letting me select anything more than 7 days old whereas I am getting
Audit data back to Apr 2020 from the O365 Compliance center

concept-audit-logs

And my goal is to pull the specific licenses assigned to each user going
back to April 2020.


azure-active-directory
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

michev avatar image
1 Vote"
michev answered

There were some issues around "too large" data being returned in such events, and it looks like MS decided to just drop the entire thing. Neither the Azure AD audit log, the Unified audit log within O365 or MCAS will show the actual SKU and what changed... which kind of makes these events useless. I'll try to get some more info on this and circle back.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

HarondelJSibble-8504 avatar image
0 Votes"
HarondelJSibble-8504 answered

Well that is decidedly disappointing.

Thanks look forward to anything you can find. As I think about it now, I remember the issue with "too large" data being returned a few years ago, just never thought it would tie in with this kind of info. I wonder what MS does on the backend if they get a subpoena for this type of data for a tenant.

The data must be accessible somewhere....

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

michev avatar image
1 Vote"
michev answered

I can see the details now, for new licensing events at least. It also turns out that few licensing flows, including group-based licensing, didnt even generate events. All started magically working after making some fuzz, go figure.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

HarondelJSibble-8504 avatar image
0 Votes"
HarondelJSibble-8504 answered michev commented

Wait a second, are you saying that rerunning my O365 Audit log queries again should now show me the missing data I am looking for?

If that's the case I'll be ecstatic when I get back to the computer tomorrow.

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

No, I'm saying that I can see the events and detailed licensing info for new license actions. Older stuff is not populated, though I've asked them to clarify whether we can expect some sort of backfill.

Also, make sure to include the "Updated user" events as some of the licensing changes end up there, don't ask me what's the logic.

0 Votes 0 ·
HarondelJSibble-8504 avatar image
0 Votes"
HarondelJSibble-8504 answered

Had to take a look, doesn't appear any better, use search queries in the web gui and while the number of records seems about the same, the actual detailed content appears to be less. I then scope to a new user added in early March and I get zero results on a license query.83939-2021-04-02-01-32-06-audit-microsoft-365-compliance.png



5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.