Microsoft: Auditing Fails to Enable or Appears Active but is Not Functional

In rare instances Auditing will fail to enable (the Blue "enable auditing" banner on the purview page comes back after being clicked) or may show as enabled but fail to generate content (Audit is created and generates a blank report). 

The next step after trying to enable auditing via PowerShell is to contact Microsoft Support for assistance.

The following option has been suggested by Microsoft to Partners to resolve this issue but we suggest contacting them first. If you choose to proceed please do so with Extreme Caution.

1. Use a Unique local-Global Admin account that has access only to the affected tenant and sign in at:  https://admin.microsoft.com

2. Open a. Billing -> b. Purchase Services -> c. Search "E5" -> d. Click "Details" below the Microsoft 365 E5 option. 

3. Click "Start free trial" option next to the Buy button:

4. Assign the trial E5 license to the Unique Local-Global admin account, bear in mind adding a license may take up to 24 hours to fully be active within the Microsoft tenant.

5. Access the Security Admin center (now Microsoft Defender).

6. Scroll down and select Audit.

7. Select a date range of a few days, add filters to narrow results, and click search.

8. Once the search is complete open the search to confirm it generated results. If it has content Auditing is now working correctly. If the search is blank Auditing is still not working and contacting Microsoft is the next step.

9. At this point Microsoft suggests leaving the license active for a day and then removing it from the tenant once confirming Auditing is functioning as expected.