Skip to main content
Panther Knowledge Base

Why is Panther not ingesting Microsoft 365 logs despite having no apparent errors?

  1. Last updated
  2. Save as PDF

Issue

I onboarded a new Microsoft 365 log source in Panther and it is not showing any errors, but it is not ingesting any logs.

Resolution

To resolve this issue, please make sure unified audit logging in Office 365 is enabled.

If this doesn't resolve the issue, please contact Panther Support.

Cause

If unified auditing is not enabled, Microsoft 365 logs will not be ingested due to the following error:

Microsoft.Office.Compliance.Audit``.DataServiceException: Tenant <tenantID> does not exist.