How to get full details from Office 365 Audit log

Hi All,

I'm trying to get some license assignment info from the Unified Audit Log via PowerShell or in Security&Compliance portal. Problem is that when I find the needed record the license options (disabled plans) are truncated. But this is actually the info I'm looking for as I need to know if Exchange license was assigned or not:

Any suggestions how to get the full info on disabled plans from audit log?

Thanks

Marek

 

Question Info


Last updated March 22, 2019 Views 2,122 Applies to:

The data should be there, it's probably truncated because of the host display settings. Simply export them to CSV or similar.

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Hi Marek,

If you would like to check a user's service status, you can use the PowerShell command below:

(Get-MsolUser -UserPrincipalName user@contoso.com).Licenses.ServiceStatus

where user@contoso.com is the user that you wish to check.

If you would like to check all user's in your tenant that are licensed along with their service status, you can use the script below to export the results to a CSV file:

$collections = @()
Get-MsolUser -All | where {$_.isLicensed -eq $true} | ForEach-Object {
foreach ($l in $_.Licenses.ServiceStatus)
{
$data = New-Object psObject -Property @{
ObjectID = $_.ObjectID
UPN =  $_.UserPrincipalName
ServiceName = $l.ServicePlan.ServiceName
ServiceStatus = $l.ProvisioningStatus
}
$collections += $data
}
}
$collections | Export-Csv C:\LicenseInfo.csv -NoTypeInformation

Note: You can change the location where the CSV will be created to your liking. By default it will be created under the C: drive with the name LicenseInfo.

Regards,

Sheen

-------------------------------------------------
If you feel a reply works for you, please kindly vote or mark it as it will be beneficial to other community members reading this thread.

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Hi Vasil,

that's not the case. The full details are not there even if you export the audit log to CSV.

Marek

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Hi Sheen,

I don't need to check user's service status. I need to find historically when and who assigned particular license to a user.

I can get the info from audit logs but as the details a truncated I can not tell which license options (disabled plans) were set when assigning of subscription plan was done.

Marek

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

What you have shown on the screenshot above is nowhere near to what the full output will look like. Here's an example exported to text file:



[Account information has been masked by the Moderator]

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Hi Vasil,

can you please share the cmdlet which you used for exporting it to text file?

Whatever I tried I'm always getting the details truncated...if there are more values or longer string I guess. Because for example my DisabledPlans string is much longer as we disable several plans in the license options.

Thanks and rgds

Marek

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Hi Marek,

The screenshot Vasil provided does not originate from the unified audit log, either from the browser or via exporting in PowerShell. As you can see, the format of the results are a little bit different.

Please provide us with the detailed steps to get to the screenshot you provided in your first reply to make sure we understand the results correctly.

Additionally, we would like to collect your tenant information to further investigate this behavior. To protect your privacy, I have sent you a private message to collect it. You can access your private message here.

Regards,

Sheen

-------------------------------------------------
If you feel a reply works for you, please kindly vote or mark it as it will be beneficial to other community members reading this thread.

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Hi Sheen,

you are right. The info Vasil posted does not come from the Unified Audit Log. This comes from Azure Audit log and the export can be made in Azure Admin portal.

The Audit log in Security&Compliance portal and also the output of search-unifiedauditlog is really truncated and does not contain all the details.

So if you need full details you need to export the logs from Azure Admin portal.

Rgds

Marek

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.