question

SanjayBhakuniHSDDSH-7922 avatar image
0 Votes"
SanjayBhakuniHSDDSH-7922 asked vipulsparsh-MSFT edited

Audit logs Activities

Audit log entries with actions by "Microsoft Substrate Management" for a newly created user. I want to know how to stop them to appear. Is it something need to fix or any data loss activity.117943-image002.png


azure-ad-audit-logs
image002.png (145.7 KiB)
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

1 Answer

vipulsparsh-MSFT avatar image
0 Votes"
vipulsparsh-MSFT answered vipulsparsh-MSFT edited

@SanjayBhakuniHSDDSH-7922 Thanks for reaching out.

The event that you see is because of a Dual-write concept which gets enabled on every tenant from Service Side. Normally when you create or modify user’s properties via Exchange Admin Center (EAC), Exchange Online PowerShell or other API, the change replicates to Azure Active Directory (AAD) through a sync mechanism which can take some time to complete. Simply put, you might not see the result of your change in AAD for a while due to this back-sync process.

In Dual -write state, when you make user object changes in Exchange the changes will now be dual-written to AAD and EXO. The end result is that the replication of those properties should be close to immediate and changes made in EXO will immediately reflect in AAD when the cmdlet completes successfully.

As part of dual-write operations, you will see audit log entries with actions taken by “Microsoft Substrate Management”. “Microsoft Substrate Management” is a service principal used by Exchange Online during dual-writing operations to AAD. These audit log entries refer to create/update/delete operations executed by EXO to AAD. These entries are informational in nature do not require any action.




Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.


5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.