Comments on: Interpreting Audit Records for Teams Meeting Recordings (Again) https://office365itpros.com/2024/06/07/teams-meeting-recordings-june24/?utm_source=rss&utm_medium=rss&utm_campaign=teams-meeting-recordings-june24 Mastering Office 365 and Microsoft 365 Mon, 10 Jun 2024 14:13:49 +0000 hourly 1 By: Tony Redmond https://office365itpros.com/2024/06/07/teams-meeting-recordings-june24/#comment-12411 Mon, 10 Jun 2024 14:13:49 +0000 https://office365itpros.com/?p=65081#comment-12411 In reply to Steve Wedge.

The change made by Microsoft in September (linked to in the article) meant that the cmdlet didn’t return the expected set of results. Adding SessionCommand ReturnLarge set fixed the problem, but at the example of including a lot more duplicate records in the returned set. That’s why my scripts now always sort the returned set to remove duplicates.

]]> By: Steve Wedge https://office365itpros.com/2024/06/07/teams-meeting-recordings-june24/#comment-12410 Mon, 10 Jun 2024 14:06:21 +0000 https://office365itpros.com/?p=65081#comment-12410 It’s worth noting that in tenants where there is a lot of activity on SharePoint & OneDrive running a a search-UnifiedAuditLog, even for a single day, may not yield the results required. I recently revisited my version of Tony’s original script as we consistently saw no results being returned. I found that I needed to amend the script to run multiple searches for a single day, I chose to run 1 for every hour, with a SessionID, SessionCommand = “ReturnLargeSet” & Resultsize = 5000. Only then were results returned which were consistent with what can be viewed via a Purview Audit Search.

]]>