-
タイトル
Azure AD events may be delayed temporarily if the agent service is not restarted after updating the web application permissions to support MS Graph API -
説明
If manually updating the web application permissions following an upgrade from 7.0.3 (or earlier) to 7.0.4 (or later) Azure AD events may be delayed for short period of time with the following messages possibly observed in the MicrosoftCloudPlugins log:
Level: INFO
Logger: MicrosoftCloud.Service.AzureAdAuditEventCollector
Function: MicrosoftCloud.Service.AzureAdAuditEventCollector.Collector
Message: Retry collecting Azure AD audit events in 5 minutes.
Level: INFO
Logger: MicrosoftCloud.Service.AzureADSignInEventCollector
Function: MicrosoftCloud.Service.AzureADSignInEventCollector.Collector
Message: AzureAD Sign-In Event collector received 401 error. Will try again after 30 seconds.
Level: WARN
Logger: MicrosoftCloud.Service.AzureAdAuditEventCollector
Function: MicrosoftCloud.Service.AzureAdAuditEventCollector.Collector
Message: AzureAD Auditor Event collector failed while getting AuditEvent report, will try again after 30 seconds error: The remote server returned an error: (401) Unauthorized.
-
原因
If the agent is already running and auditing when the permissions are updated it can take some time before the new permissions are applied.
-
対策
Restart the Change Auditor agent service once the permissions are updated to ensure the changes are applied immediately and auditing continues.