Checking licence changes in audit logs

Question

Hi everyone,

This morning I found out that 5 of our users had lost their o365 licenses. I had to manually assign these licenses again. When i want to check the audit logs, to see what happened, I notice that the change of licenses is not logged. Do I need to turn this kind of logging manually on?

Kind regards,

Rick van Oosterhout

Answer 1

Much of the logging in O365 is not on by default so you should verify that all is turned on as a "Changed User License" is one of the things you can search for in the Audit Log Search.

Answer 2

Hi Rick,

May I know if the issue has been resolved? If you need further assistance, please share more information I mentioned with us. 

Regards,

Eli

Answer 3

Hi Rick,

You could follow the picture to search licenses assigned logs again.

If the action that assigning licenses is still not logged, it can take up to 24 hours for the admin events related audit log entry to be displayed in the search results.

Here is Search the audit log in the Office 365 Security & Compliance Center for your reference.

Besides, if the issue occurs again, I would like to collect following information:

1.Are these users Online users or local AD users?

2.What licenses do they have before these license lost?

Regards,

Eli

Answer 4

How can I check if those are turned on and if not, how can I turn those on?

Thanks!