Skip to main content

Audit Logs Subscription Issue

This issue occurs when Microsoft 365 Unified Audit Logging is not enabled, or when the configuration has not yet fully propagated in the tenant.

It is most commonly encountered in:

  • New Microsoft 365 tenants
  • Developer or trial tenants
  • Recently configured Exchange Online environments

Symptoms​

You may see the following warning in Syskit Point:

Audit Logs Subscription issue! Audit logs subscription is not enabled. Please contact your Administrators or Syskit Support for help.

You may also encounter PowerShell errors similar to:

The command you tried to run isn't currently allowed in your organization.
To run this command, you first need to run the command:
Enable-OrganizationCustomization

Or:

Enable-OrganizationCustomization:
This operation is not required. Organization is already enabled for customization.

Solution​

There are two supported ways to enable auditing:

  • Microsoft Purview portal (recommended)
  • Exchange Online PowerShell

This is the fastest and easiest approach.

  1. Open the Microsoft Purview audit search portal.
  2. Sign in with a Global Administrator or Compliance Administrator account.
  3. If auditing is not enabled, a banner with the Start recording user and admin activity button is shown.
  4. Click the button to enable auditing.
  5. Wait for Microsoft 365 to complete provisioning.

Option 2: Enable Auditing With PowerShell​

Step 1: Install and Connect to Exchange Online PowerShell​

Install-Module ExchangeOnlineManagement -Scope CurrentUser
Import-Module ExchangeOnlineManagement

Connect-ExchangeOnline

Step 2: Enable Organization Customization​

Enable-OrganizationCustomization

You may see the following output:

This operation is not required. Organization is already enabled for customization.

This is normal and simply means customization has already been enabled previously.

Step 3: Enable Unified Audit Log Ingestion​

Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true

Step 4: Verify Configuration​

Get-AdminAuditLogConfig | FL UnifiedAuditLogIngestionEnabled

The expected result is:

UnifiedAuditLogIngestionEnabled : True
warning

Please note! Microsoft 365 audit configuration changes are not always immediate. Even after enabling auditing successfully:

  • PowerShell commands may still fail temporarily
  • Syskit Point may continue showing the warning
  • The Microsoft Purview UI may not update immediately

According to Microsoft documentation, changes can take from 30 minutes to several hours, and up to 72 hours in some environments. This is especially common in developer, trial, and newly created tenants.

Common Scenario​

A common sequence is:

  1. Enable-OrganizationCustomization reports that customization is already enabled.
  2. Set-AdminAuditLogConfig still fails temporarily.
  3. Microsoft backend provisioning completes later.
  4. Re-running the command succeeds.
  5. Syskit Point begins collecting audit logs normally.

In many cases, simply waiting and retrying later resolves the issue.

Troubleshooting Checklist​

Verify Auditing Status in Purview​

Open the Microsoft Purview audit search portal.

If you see Start recording user and admin activity, auditing is not enabled yet.

Verify PowerShell Status​

Run:

Get-AdminAuditLogConfig | FL UnifiedAuditLogIngestionEnabled

If the result is:

UnifiedAuditLogIngestionEnabled : False

Auditing is still disabled.

Use a Fresh PowerShell Session​

Sometimes stale sessions cause misleading errors. Reconnect and retry the command:

Disconnect-ExchangeOnline -Confirm:$false
Connect-ExchangeOnline

Additional Notes​

  • Production tenants usually already have auditing enabled by default.
  • This issue is more common in development or newly provisioned tenants.
  • Exchange Online PowerShell must be used for these commands.
  • Global Administrator permissions are recommended.
info

For initial setup steps and details on enabling auditing from Syskit Point's perspective, see Turn On Auditing.

References​

You can find additional information in the following Microsoft Learn articles:

Last updated on