Whenever I try to audit using Purview, I get no results

Question

I was hoping I can get assistance as to purview audits.

I was trying to run an audit on my own account and other accounts and I am getting no results even though I know I should be getting results.

Any chance anyone can help me find out what's going wrong ?

I am willing to send screenshots for proof.

Answer 1

Hello,

Happy New Year to all.

I wanted to mention that I had a conversation online with someone from Microsoft support, right on their website and I was advised to purchase an E3 Mobility + Security addon.

I was advised that doing so will assist in getting the audit results.

I did that, I added the license addon and we are still getting blank results for things that we know for sure should be showing results.

I confirmed that with powershell that audits are enabled.

I am not sure what to do anymore.

Answer 2

Unfortunately none of the information provided was useful.

Sorry to say.

I ended up contacting Microsoft sales and I was advised that I need an E3 Mobility + Security Add-on to achieve what I need.

I will update if this is successful.

Answer 3

Hello Liav,

Thank you for your reply,

Based on my research i find this information below:

Referenece: https://learn.microsoft.com/en-us/purview/audit-premium#faqs-for-audit-premium 

And base on the available license you have shared i can't see any other license, i can see that you have E3 , does E3 license is assigned to the affected account? since this is a new document,

Please let try this PowerShell command to retrieve all the events from (change the date and month and run the command)

Connect your PowerShell command to exchange and then the below command and check if you can see the event you are looking for:

Search-UnifiedAuditLog -StartDate "6/1/2023 8:00 AM" -EndDate "6/1/2023 6:00 PM" -RecordType ExchangeAdmin -SessionCommand ReturnLargeSet

Reference: https://learn.microsoft.com/en-us/powershell/module/exchange/search-unifiedauditlog?view=exchange-ps 

We look forward to your reply. We will continue to assist you based on the information you provide. I sincerely appreciate your patience and cooperation.   SincerelyEben Ezer Tres | Microsoft Community Moderator

Answer 4

Any other suggestions ?

Answer 5

I can confirm that my name is on the list of members within the "Audit Manager" Role within the Purview permissions section.