Resolve "Microsoft Audit Log is inaccessible" errors for OneDrive

Overview

If audit is not enabled (or has been disabled) in your Microsoft environment, the Incydr OneDrive data connection enters an Error status and monitoring stops. This error message appears in the details for that data connection:

The Microsoft Audit Log is inaccessable. Re-enable the audit log in Microsoft 365 Compliance Center to return this data connection to monitoring.

This article helps you resolve the error.

Resolve inaccessible audit log errors

To resolve the issue, turn auditing on in your Microsoft environment. After you turn on audit, Incydr detects the change and returns the connection to the Monitoring status within 24 hours.

Incydr monitoring requires that audit is turned on
Audit must be turned on in your Microsoft environment for Incydr to monitor files shared in your corporate OneDrive cloud storage or email attachments sent from your corporate Microsoft Office email accounts. If audit is off, Incydr cannot collect data and no file events appear in Forensic Search.

If you have one of the Microsoft business licenses, you may need to turn on audit in your environment before connecting with Incydr. Unless it has previously been turned off, customers with a Microsoft enterprise license may already have audit turned on by default.

External resources

Microsoft documentation:

• Turn auditing on or off
• Reimagine productivity with Microsoft 365 and Microsoft Teams
• Powerful tools to support your enterprise

Related topics

• Configure Microsoft for the Incydr OneDrive data connection 
• Connect Incydr to OneDrive 
• Permissions required for the Microsoft OneDrive connector