Some tenants do not have the new Purview schema and so are not gathering audit logs today - with workaround solution

[Jenefer-Monroe]

Does this bug already exist in our backlog?

• I have checked and confirm this is a new bug.

Describe the issue

Bad news.

We responded to this change https://admin.cloud.microsoft/?ref=MessageCenter/:/messages/MC912045

It did not occur to us that they might not make this change everywhere at the same time. So some tenants are not getting their audit logs at this time.

If this hits you the only workaround will be to install this workaround solution which is basically the old solution, from before we updated to the new schema.

1. Install this solution auditlogsbackupwithoutpurview_1_0_0_1_managed.zip in your CoE envt
2. Turn on the version of Admin | Audit Logs | Sync Audit Logs (V2) in this new solution
3. Turn off the version of Admin | Audit Logs | Sync Audit Logs (V2) in Core

Expected Behavior

No response

What solution are you experiencing the issue with?

Core

What solution version are you using?

4.45

What app or flow are you having the issue with?

Admin | Audit Logs | Sync Audit Logs (V2)

What method are you using to get inventory and telemetry?

None

Steps To Reproduce

No response

Anything else?

No response

[AMSoftwareNL]

Hi, I see you created a workarond for the audit log sync flow and the new Audit Log Format. Is there also a fix for the Import Audit Log from CSV. I'm currently trying to import the exported audit logs from Purview into the CoE. These go back 6 months.

The import flow checks on the "New Format" of the audit log line based on the text 'powerplatform.analytics.resource.power_app.id' in the audit log line. If the text isn't there the flow skips the entire record. As a result purview audit information from before november isn't imported at all. Instead it should import with the old format if it isn't the new format.

Do you have a new flow or workaround for this?

[Jenefer-Monroe]

Sure I can do that.

I added the following flow: BackupSync Admin | Audit Logs | Load events from exported Audit Log CSV file to the solution now. Here it is:

auditlogsbackupwithoutpurview_1_0_0_2_managed.zip

[PPCan]

@Jenefer-Monroe just to confirm, signs of failure would be no records in the Audit Log table AND/OR a failed run of the sync flow?

[Jenefer-Monroe]

Sorry I'm not currently funded for CoE work as of today. Please post this as a new issue (question) and reference this issue so that your question can be addressed.