Unified logs (audit logs from purview) not working

Priya Jayaraman 486 Reputation points
2026-09-23T03:57:50.51+00:00

Unified logs are not working after 19th September.

Get-adminauditlogconfig,auditdisabled is false

Get-adminauditlogconfig,UnifiedAuditLogIngestionEnabled is true

Any service degradation from Microsoft end?

Cheers

Priya

Microsoft Security | Microsoft Purview

2 answers

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-09-23T03:58:05.5966667+00:00

    No Microsoft service degradation is documented in the available material.

    The supported checks are:

    1. Verify the setting in Exchange Online PowerShell, not Security & Compliance PowerShell: 
         Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled
      True means audit log search is turned on.
    2. Confirm the change history for auditing status: 
         Search-UnifiedAuditLog -Operations Set-AdminAuditLogConfig
      In the returned records, check the AuditData property for UnifiedAuditLogIngestionEnabled to see whether auditing was turned on or off, when it changed, which admin changed it, and the source IP address.
    3. Confirm permissions. To search the audit log, the required roles are Audit Logs or View-Only Audit Logs in Microsoft Purview, and to access audit cmdlets, the same roles are required in Exchange admin permissions.
    4. If needed, re-enable unified audit log ingestion in Exchange Online PowerShell: 
         Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true

    Important: UnifiedAuditLogIngestionEnabled always appears as False in Security & Compliance PowerShell, even when audit log search is actually enabled. Also, Set-AdminAuditLogConfig for this setting is not available there.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

  2. Maksood Ahmed 15 Reputation points Microsoft External Staff Moderator
    2026-09-28T14:26:33.6233333+00:00

    As the issue occurs with both Search-UnifiedAuditLog and the Purview Audit Search GUI, while AuditDisabled = False and UnifiedAuditLogIngestionEnabled = True, the next recommended step is to open a Microsoft Support case for further investigation.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.