Feedback by UserVoice

How can we improve compliance or protect your users better in Office 365?

Audit license assignement by subscription / Product

We should be able to see with subscription / product was assigned or removed to an office 365 Account. In the Actual audit log, there is only few information that is not relevant at all! We must be able to know who and when a specific office 365 workload is assign to a User, example (office 365 pro plus, or Skype for business)

259 votes
Vote
Sign in
(thinking…)
Sign in with: facebook google
Signed in as (Sign out)
You have left! (?) (thinking…)
Ronald Bigras shared this idea  ·   ·  Flag idea as inappropriate…  ·  Admin →

11 comments

Sign in
(thinking…)
Sign in with: facebook google
Signed in as (Sign out)
Submitting...
  • Kaustubh Phatak commented  ·   ·  Flag as inappropriate

    Search-UnifiedAuditLog -StartDate 1/1/2019 -EndDate 3/21/2019 -RecordType AzureActiveDirectory -

    Operations "Add user."-ResultSize 2000| fl >AssignLic.csv

    We can check in the Output of the above command for the string "AssignedLicense " to go through the logs of assigning license to a user.

    Powershell command to check activity about license :

    Search-UnifiedAuditLog -StartDate 1/1/2019 -EndDate 3/21/2019 -RecordType AzureActiveDirectory -Operations "Change user license."-ResultSize 2000| ft CreationDate,UserIds, RecordType, Operations ,AuditData

  • Sam Buccieri-Gillett commented  ·   ·  Flag as inappropriate

    I see it's possible to get the full, not truncated audit log string for 'updated user' events in the unified audit log via the azure portal, as detailed in a comment here

    https://answers.microsoft.com/en-us/msoffice/forum/msoffice_o365admin-mso_dep365-mso_o365b/how-to-get-full-details-from-office-365-audit-log/a4e8767e-7095-412c-b1a2-f48f76d2eb6e

    That thread is now inexplicably locked, and I've found that exporting the CSV from the Azure Portal provides a mal-formatted file; there are commas within some fields, so parsing it as a comma-separated CSV is impossible, and it would take some crazy regex to make it readable. Even after you've done that you'd have to write some customer parser for the actual data, since it's not in any standard format.

    I'm guessing there are some 3rd party solutions out there for £££?

  • Anon commented  ·   ·  Flag as inappropriate

    Nearly two years on, and this essential functionality is still missing. Can't you spend a little more effort on getting the basics right before launching yet another product?

  • Frustrated commented  ·   ·  Flag as inappropriate

    I don't really think you can call this auditing. It's basically a log file that says "something happened regarding licenses on this account somewhere".

  • Jason Cramsey commented  ·   ·  Flag as inappropriate

    We need to be able to easily retrieve when a specific license was assigned to an account. For example, when a PSTN license or EMS license was assigned. For our immediate needs, down to the license plan option level would not be necessary, but maybe that would be helpful in the future or to others.

  • Anonymous commented  ·   ·  Flag as inappropriate

    100 Million Customers on Office 365 Globally and we don't have a way to see who is assigning or removing licenses?? Its a shame! Simply put.

  • Anonymous commented  ·   ·  Flag as inappropriate

    We're March 2017 and this still is not usefull at all !!
    Changes to license options and adding an additional license (like Project client) is not logged at all, just "update user"... with all the **** info that is worth nothing.

  • Andreas E. commented  ·   ·  Flag as inappropriate

    And also for example a Exchange license is removed from Office 365 main license.
    This is a must to Audit if a Admin make a mistake with a script or something else.

Feedback and Knowledge Base