Why audit data for SharePoint Online is collected behind the schedule or missing?
Due to Microsoft Management Activity API limitations, Netwrix Auditor may experience delays when collecting audit data.
- It may take up to 12 hours since the Managed Object creation to start collecting audit data. For more information, refer to the following Microsoft article: https://msdn.microsoft.com/office-365/office-365-management-activity-api-reference
- After initial configuration, it may take approximately 15 minutes for events to appear in the activity log after the change occurred.
- In case of Microsoft maintenance works, audit data may be unavailable for a few days. For more information, refer to the following Microsoft article: https://support.office.com/en-us/article/Search-the-audit-log-in-the-Office-365-Security-Compliance-Center-0d4d0f35-390b-4518-800e-0c7ec95e946c?ui=en-US&rs=en-US&ad=US
Also, Microsoft automatically removes events that are older than 7 days—Netwrix Auditor will be unable to collect them. To ensure your audit data is always complete, run data collection regularly.