Purview Script

Automated version of Troubleshooting Purview activation errors and delays. It connects to Exchange Online, forces a disable then re-enable of audit log ingestion, and confirms the result. If the tenant is dehydrated, it runs Enable-OrganizationCustomization, waits for it to finish, then re-enables audit logging. If activation is genuinely refused, it prints a diagnostic (account roles, tenant hydration, license and subscription status).

Repair-PurviewAuditLogging.ps1

17KB

Open

Run it from Windows PowerShell or Azure Cloud Shell (PowerShell mode). It refuses to run on macOS/Linux, where the Exchange Online module fails on write operations.

No Windows machine? If the tenant has an active Azure subscription, run it from Azure Cloud Shell in PowerShell mode: upload the script and run it without -AdminUpn. Cloud Shell reuses your session, so there is no sign-in prompt. Purview itself does not require an Azure subscription.

Run it

1

Download the script

Download Repair-PurviewAuditLogging.ps1 from the link above.

2

Allow script execution

In PowerShell, run this once per window (session-only, nothing permanent):

Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass

3

Run it with the admin account

Replace <[e-mail]> with a tenant admin. A browser sign-in window opens; the script does the rest.

cd C:\path\to\the\folder
.\Repair-PurviewAuditLogging.ps1 -AdminUpn <[e-mail]>

4

Verify later

False right after the run is normal: Microsoft applies it within a few minutes (up to about 60 min). Reconnect to check:

Connect-ExchangeOnline -UserPrincipalName <[e-mail]> -ShowBanner:$false
Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled

True means it is done.

If it fails

The script runs a diagnostic and tells you which case you are in. Send the .log file it created to [e-mail].

• Dehydrated tenant: handled automatically. The script runs Enable-OrganizationCustomization, waits for hydration, then re-enables audit logging.

• 403 Forbidden / refused: a real rejection. The account lacks the right role (the Audit Logs role, granted through Organization Management or Compliance Management), or the tenant has no license that includes Exchange Online.

• Server-side error: a transient "try again later" from Microsoft. The script already retries; if it persists, run it again a few minutes later.