Purview activation errors

After enabling audit logging in Microsoft Purview, you may see a message such as:

Sorry, we're having trouble figuring out if activity is being recorded. Try refreshing the page.

In most cases this does not mean the activation failed. It reflects a delay on Microsoft's side between the moment audit logging is enabled and the moment it is effectively recording activity. This delay can take from a few minutes up to several hours, and it cannot be sped up from our side.

The error message in the Purview web portal is not a reliable indicator. It does not indicate whether Purview is actually active, only that the portal cannot confirm it at that moment.

"Enable-OrganizationCustomization" error

A different message means the tenant has never been customized (it is "dehydrated"). Audit logging cannot be turned on until that one-time setup has run:

The command you tried to run isn't currently allowed in your organization. To run this command, you first need to run the command: Enable-OrganizationCustomization.

Unlike the delay above, this one requires an action. Two options:

• The portal shows a Complete the organization configuration prompt: clicking Yes runs the customization, but it does not always re-enable audit logging afterwards, so you often end up back on the error.

• The reliable fix is the PowerShell steps below, which run the customization and then re-enable audit logging in one go. The Purview Script does this end to end: it runs the customization, waits for the tenant to finish hydrating, then enables audit logging automatically.

Activate audit logging with PowerShell

The most reliable way to activate Purview audit logging is to force it directly through PowerShell, instead of relying on the web portal.

You can run these commands either from PowerShell installed on your machine, or from Azure Cloud Shell directly in the browser.

1

Connect to Exchange Online

Local PowerShell

Install the module, then connect. Replace <[e-mail]> with an account that has administrative permissions on the tenant.

Install-Module -Name ExchangeOnlineManagement
Import-Module ExchangeOnlineManagement
Connect-ExchangeOnline -UserPrincipalName <[e-mail]>

Azure Cloud Shell

Azure Cloud Shell requires an active Azure subscription on the tenant. If none is available, use local PowerShell instead.

Open Azure Cloud Shell in PowerShell mode. If the top of the terminal shows a Switch to Bash button, you are already in PowerShell mode.

Connect to Exchange Online:

Connect-ExchangeOnline

2

Force the activation

Run the commands one by one, in order. Forcing a disable then a re-enable is what reliably unblocks tenants stuck on the error.

Step 1: disable audit logging

Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $false

Step 2: re-enable it

Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true

Expand this only if the re-enable command returns an error

On tenants that have never been customized, the re-enable command can fail with:

The command you tried to run isn't currently allowed in your organization. To run this command, you first need to run the command: Enable-OrganizationCustomization.

Run the customization command, then check that the tenant is no longer dehydrated:

Enable-OrganizationCustomization
Get-OrganizationConfig | Format-List IsDehydrated

IsDehydrated should return False. Once it does, run the re-enable command again.

Step 3: confirm the status

Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled

UnifiedAuditLogIngestionEnabled should now return True.

Once it returns True

A True result means the command went through, but Purview is not active instantly: Microsoft takes time to actually start recording activity, sometimes several hours. Refresh the Purview portal after a while and the error message should be gone.

If the error is still there after several hours, run the force activation again (set $false then $true). If it still does not work after that, the issue is most likely tied to the tenant licensing or permissions. Contact our team at [e-mail] with the result of the command so we can help diagnose it.