search

microsoft / coe-starter-kit

Other
754 stars 225 forks source link

[CoE Starter Kit - BUG] Audit Log Sync V2 not capturing logs #9251

Open DarkestOfNights opened 4 days ago

DarkestOfNights commented 4 days ago

Does this bug already exist in our backlog?

Describe the issue

After the November 2024 update, the Audit Log Sync V2 Flow is not capturing any LaunchPowerApp log events when using the Graph connector. In reviewing flow runs, Events are returned from the query, but are filtered out prior to processing due to all being of RecordType 45 rather than 256. Any 256-type records in our tenant are only ApiEndpointCallEvent actions. This could just be an issue with GCC tenants.

Expected Behavior

Audit logs are ingested

What solution are you experiencing the issue with?

Core

What solution version are you using?

4.45

What app or flow are you having the issue with?

Admin | Audit Logs | Sync Audit Logs (V2)

What method are you using to get inventory and telemetry?

Cloud flows

Steps To Reproduce

No response

Anything else?

No response

Jenefer-Monroe commented 4 days ago

Oh no. We were responding to this change https://admin.cloud.microsoft/?ref=MessageCenter/:/messages/MC912045 It did not occur to me that they might not make this change everywhere.

I've reached out to the amazing internal GCC team to see if they know what's going on. And in the meantime I think the only workaround would be to import the old flow to run while we sort out what to do.

Here is the old flow in a new solution so that it can be imported outside of Core. Please import and turn this one one, and the real one in Core off for now. auditlogsbackupwithoutpurview_1_0_0_1_managed.zip

Let me know how it goes.

DarkestOfNights commented 4 days ago

We have that same alert under a different message number: MC912042, the change just hasn't made it to our logs quite yet. I'll import this and let you know in just a few minutes. Thanks!

DarkestOfNights commented 4 days ago

@Jenefer-Monroe That worked, thank you. I'll be keeping an eye on our logging solution to determine when 256 messages include anything other than just ApiEndPointCallEvent actions so that I can move back over to the original flow. I am watching those messages for other governance purposes, and this may explain why I am not getting all of the messages I am expecting otherwise.

I will keep you updated when the logs switch over properly for GCC.