O365 Audit Log Shows Incorrect WorkSpaceName

Question

When viewing an entry in the O365 Audit Log Search it shows a different WorkSpaceName to the actual Workspace the report/dashboard was viewed through. When there is a difference, it always shows the same workspace. It started on 4th October 2018 to date of posting this and it was ok before then. Most records are still correct. This only affects around 30% of records from that date.

v-yulgu-msft · Answer

Hi&nbsp;Marc625,
&nbsp;
I was not able to reproduce this same problem on my side.&nbsp; What is the difference? Is there any similarity&nbsp;between the different workspace names&nbsp;of the&nbsp;30% of records? Could you show us an example?
&nbsp;
Best regards,
Yuliana Gu

marc625 · Answer

Hi&nbsp;v-yulgu-msft,&nbsp;Thanks for getting back to me.&nbsp;Here is a example screenshot of a View from my account. The Workspace is always "Donald" from all users. It's not a Workspace I can see in Power BI or O365.&nbsp;

stefan74 · Answer

We experience the same, but not with "Donald" as WorkspaceName but "Torsten", which also does not exist in our envoironment.

emilylime · Answer

We have a Donald too!&nbsp;I am dubious about the WorkSpaceId and WorkSpaceName columns myself. When I look at the entire history of our audit log (Since around mid-Feb 2018) data, the Workspace column data doesn't always parse with what I know to be true, and it isn't always consistent. Here are a few cases:&nbsp;1: A user has a hit with "My Workspace", and it is correct. Something they were working on in their workspace.2: A user&nbsp;hits&nbsp;a known report published in an App (as an aside: is it the Workspace being logged there, or the app? Is the app usage logged anywhere?) and it is correct.3: A user has a hit with "My Workspace" in both the ID and the Name column, and it is&nbsp;incorrect. I know where the report they're using is published and there is&nbsp;no way&nbsp;it is in their personal workspace. There are a lot of these.4: A user has a hit with My Workspace in the ID and their first name in the Name column, so we have a bunch of workspaces with first names. By the by, sometimes&nbsp;other&nbsp;peoples' names show up as viewing a report in this My Workspace, so I'm not even sure it's true. And the case in #3 and #4 is happening simultaneously; we have first name workspaces and My workspaces being logged interspersed.5: A user has a hit with My Workspace in ID and Donald in the Name column. This was a weird series that seems to have mostly abated now but did plague us in October it seems.&nbsp;Either way, I can't trust the data in either of those Workspace columns at all. I don't know how to parse the historical data to scrub for those things because it is&nbsp;inconsistently&nbsp;logged incorrectly.&nbsp;Stefan74&nbsp;do you have a person named Torsten in your org? Per my #4 above that's how we wound up with a bunch of workspaces with first names. Doesn't explain why we had so many Donalds, though, because all sorts of people were showing up in there.

mitchm · Answer

Hi all,&nbsp;&nbsp; &nbsp;We are also seeing Donald (see my post from last week:&nbsp;https://community.powerbi.com/t5/Desktop/App-Workspace-Name-Changed-in-Audit-Logs/m-p/562311#M265318&nbsp;We are escalating to our Microsoft rep, if I hear anything I will pass it along.

Forum Discussion

O365 Audit Log Shows Incorrect WorkSpaceName

5 Replies

Related content

Mirrored Databases Auditing

Network Protection Audit

PBI audit logs

Incorrect turnover total

Auditing and monitoring