Title: Some users may have encountered delays of up to 14 days for some audit records in Microsoft Purview Audit (Standard)
User impact: Users may have encountered delays of up to 14 days for some audit records in Microsoft Purview Audit (Standard).
More info: Users may have also seen the following audit records incorrectly duplicated: “Workload == AzureActiveDirectory” and “RecordType == AzureActiveDirectory”.
Final status: We’ve completed deploying the fix to the affected infrastructure that’ll utilize an alternative way to re-ingest the logs and confirmed that this has remediated impact. We’re continuing to review system logs and telemetry to identify the root cause of the issue.
Scope of impact: Impact was specific to some users who were served through the affected infrastructure.
Start time: Tuesday, February 20, 2024, at 12:00 AM UTC
End time: Tuesday, March 5, 2024, at 9:30 AM UTC
Root cause: An issue with the way logs are ingested by the service may have caused delays of up to 14 days for some audit records in Microsoft Purview Audit (Standard).
Next steps:
– We’re further reviewing the event and the circumstances that lead to impact, so that we can identify the root cause of impact and next steps that’ll help us further improve the reliability and resiliency of our service.
This is the final update for the event.
