PowerLeap Logo

Copilot Studio Friction

Get notified when this record changes

One email when the status or the fix changes — double opt-in, no tracking, unsubscribe in every email.

Admin actions are missing from the audit log

Regressedsince 8 July 2026

Last verified

Details & related

Assessment

Confidence
CorroboratedMultiple independent sources describe the same behaviour.
Severity
Degrading
Typical time lost
Hours

Identification

Governance & DLPObservability

Verification & changes

  1. Verified

    Doc check by human: Datadog logging-gaps post fetched on 2026-07-08: confirms the Aug–Sep 2025 gap, the 2025-10-05 remediation, and a regression where two of four events log inconsistently through early 2026 (MSRC could not replicate as of March 2026). Test-tenant sampling repro is pending.

  2. Change

    Provisionally approved by the Product Owner; external LLM quality review pending.

  3. Change

    Initial record created from the seed dossier (migration wave 1).

Related

Are you in the right place?

  • You remove an agent's authentication, and no entry appears in the audit log.
  • You share or publish an agent, and the action is not recorded.
  • You disable Application Insights logging, and nothing logs that change.
  • Your audit search returns fewer admin events than the changes you made.
  • The gap seems to come and go between platform updates.

If instead other agents use your agent with no trace → see Other agents can use your agent. If instead a publicly reachable agent leaks data → see A publicly reachable agent leaks data.

What's happening

Some admin actions on an agent should create an audit log entry. Four of them did not, between late August and late September 2025. Those actions were removing authentication, disabling logging, sharing, and publishing. Security researchers reported it, and Microsoft fixed it on 2025-10-05, as Datadog documents. Then the fix slipped: two of the four events began logging inconsistently again. That regressed state is documented through early 2026. So an admin change can happen and leave no reliable record. Picture a reception sign-in book where some visitors' lines stay blank. You cannot tell from the book alone whether everyone signed in.

For technicians

The four operations are BotUpdateOperation-BotAuthUpdate, BotUpdateOperation-BotAppInsightsUpdate, BotUpdateOperation-BotShare, and BotUpdateOperation-BotPublish. Datadog reported the gap to MSRC on 2025-09-02, and Microsoft remediated it on 2025-10-05. Datadog's updated post documents a regression: two of the four events log inconsistently after the fix. As of 2026-07-08, MSRC reported it could not replicate the behavior, while Datadog's test data stood. Treat audit completeness here as a moving state, not a settled one. Microsoft documents these operations as auditable and shows how to view them in Purview.

How to fix it

Solution 1

Community workaround

Verify audit events by sampling, not by assumption

  1. After a sensitive admin action, note the exact action and time.
  2. Open the audit log in Microsoft Purview.
  3. Search for the matching event by operation name and time.
  4. Confirm the entry exists before you trust the log.

✅ You should now see: an audit entry that matches the action you just took.

Solution 2

Community workaround

Add detections on the four key operations

Use this to catch missing events over time.

  1. In Microsoft Purview Audit or your SIEM, identify the four operations above.
  2. Create a detection that expects each operation when its change occurs.
  3. Alert when a change happens but its event is absent.
  4. Re-check the detections after every platform update.

✅ You should now see: an alert when an admin change produces no audit event.

Check that it worked

Make one low-risk admin change on a test agent. For example, share it with a single colleague, and note the time. Search the audit log for the sharing event. Expected: a matching entry within the documented delay. If it is missing, the regression is affecting you; rely on sampling and detections.

If it didn't work

  • The event is delayed, not missing. Audit entries can lag. Wait, then search again before you conclude a gap.
  • You searched the wrong place. Confirm you use Microsoft Purview Audit for the right tenant.
  • Auditing was never on. Check that unified audit logging is enabled for your organization.
  • The event truly did not log. This is the documented regression. Keep sampling, and keep your detections running.

Prevent it next time

  • Add an audit-sampling step to your security publish gate, and repeat it after each platform update.
  • Never treat "it was fixed" as permanent; re-verify audit events on a schedule.
  • Keep detections on the four key operations, so a silent gap raises an alert.

Evidence

  • Security researchsecuritylabs.datadoghq.com

    Datadog documents that four admin operations logged no audit records in Aug–Sep 2025, that Microsoft remediated them on 2025-10-05, and that two of the four events have logged inconsistently since — a documented regression.

  • Official documentationlearn.microsoft.com

    Microsoft documents which Copilot Studio admin, maker and user operations are audited and how to view them, supporting sampling and detection guidance.

  • Official documentationlearn.microsoft.com

    Microsoft Purview documents how Copilot and agent activity is captured in the unified audit log.