Comments on: Why Microsoft 365 Audit Logs Lack Proper Fit and Finish

By: Arleta

Arleta — Mon, 10 Oct 2022 13:14:53 +0000

Hoi Vasil,

Can we read *eventdata* from the audit logs in any automated way (PNP, M365 API, ExchangeOnline)?

Specifically, I am looking for a sensitivity label which USED TO be applied before a user removed it. We can find the removal event in the events, the site url, but the eventdata property is notoriously empty.

Our alternative is to stamp every site with a property in a property bag 🙁

By: Sunil Dahiya

Sunil Dahiya — Wed, 15 Sep 2021 14:17:46 +0000

Thanks for the post and great explanation. Encountered this today and was not able to cater customer’s license audit request.

By: Liam

Liam — Fri, 23 Apr 2021 19:32:33 +0000

Thanks for this post – I was just Googling for how I can tell from the audit data for the “Change user license” operation what license was added or removed. I’m glad I wasn’t missing something obvious, but absolutely agree that the current way these actions are logged is unsatisfactory.