Microsoft 365: Auditing fails to enable or appears active but is not functional
In rare instances, auditing will fail to enable (the blue enable auditing banner on the purview page returns after being clicked) or may show as enabled but fail to generate content (audit is created and generates a blank report).
The next step after trying to enable auditing via PowerShell is to contact Microsoft Support for assistance.
IMPORTANT The following option has been suggested by Microsoft to partners to resolve this issue, but we suggest contacting them first. If you choose to proceed, do so with caution.
- Sign in to the Microsoft 365 admin center using a unique local global admin account that has access only to the affected tenant.
- From the left navigation menu, navigate to Billing > Purchase services. Search E5, and click Details underneath the Microsoft 365 E5 option.
- Click Start free trial next to Buy.
- Assign the trial E5 license to the unique local global admin account, bearing in mind adding a license may take up to 24 hours to be fully active within the Microsoft tenant.
- Access the Security admin center (Microsoft Defender).
- Scroll down and click Audit.
- Select a date range of a few days, add filters to narrow results, and click Search.
- Once the search is complete, open the search to confirm it generated results. If it contains content, auditing is now working correctly. If the search is blank, auditing is still not working, and contacting Microsoft is the next step.
- At this point, Microsoft suggests leaving the license active for a day and then removing it from the tenant once confirming auditing is functioning as expected.
