If manually updating the web application permissions following an upgrade from 7.0.3 (or earlier) to 7.0.4 (or later) Azure AD events may be delayed for short period of time with the following messages possibly observed in the MicrosoftCloudPlugins log:
Message: Retry collecting Azure AD audit events in 5 minutes.
Message: AzureAD Sign-In Event collector received 401 error. Will try again after 30 seconds.
Message: AzureAD Auditor Event collector failed while getting AuditEvent report, will try again after 30 seconds error: The remote server returned an error: (401) Unauthorized.
You need to be signed in and under a current maintenance contract to view premium knowledge articles.