Audit license assignement by subscription / Product
We should be able to see with subscription / product was assigned or removed to an office 365 Account. In the Actual audit log, there is only few information that is not relevant at all! We must be able to know who and when a specific office 365 workload is assign to a User, example (office 365 pro plus, or Skype for business)
Kaustubh Phatak commented
Search-UnifiedAuditLog -StartDate 1/1/2019 -EndDate 3/21/2019 -RecordType AzureActiveDirectory -
Operations "Add user."-ResultSize 2000| fl >AssignLic.csv
We can check in the Output of the above command for the string "AssignedLicense " to go through the logs of assigning license to a user.
Powershell command to check activity about license :
Search-UnifiedAuditLog -StartDate 1/1/2019 -EndDate 3/21/2019 -RecordType AzureActiveDirectory -Operations "Change user license."-ResultSize 2000| ft CreationDate,UserIds, RecordType, Operations ,AuditData
Tejas Surve commented
Can you please add the functionality to show which Licenses are changed.
Sam Buccieri-Gillett commented
I see it's possible to get the full, not truncated audit log string for 'updated user' events in the unified audit log via the azure portal, as detailed in a comment here
That thread is now inexplicably locked, and I've found that exporting the CSV from the Azure Portal provides a mal-formatted file; there are commas within some fields, so parsing it as a comma-separated CSV is impossible, and it would take some crazy regex to make it readable. Even after you've done that you'd have to write some customer parser for the actual data, since it's not in any standard format.
I'm guessing there are some 3rd party solutions out there for £££?
Nearly two years on, and this essential functionality is still missing. Can't you spend a little more effort on getting the basics right before launching yet another product?
I don't really think you can call this auditing. It's basically a log file that says "something happened regarding licenses on this account somewhere".
Jason Cramsey commented
We need to be able to easily retrieve when a specific license was assigned to an account. For example, when a PSTN license or EMS license was assigned. For our immediate needs, down to the license plan option level would not be necessary, but maybe that would be helpful in the future or to others.
100 Million Customers on Office 365 Globally and we don't have a way to see who is assigning or removing licenses?? Its a shame! Simply put.
Erwin Fiebig commented
This should be mandatory. It is crucial for a better license management.
We're March 2017 and this still is not usefull at all !!
Changes to license options and adding an additional license (like Project client) is not logged at all, just "update user"... with all the **** info that is worth nothing.
Andreas E. commented
And also for example a Exchange license is removed from Office 365 main license.
This is a must to Audit if a Admin make a mistake with a script or something else.
I\m surprised this feature is not already available !