Your compliance team searches the audit log for a Teams meeting event and finds nothing. The meeting happened, but the audit record is missing. This often happens after an administrator changes a compliance policy, such as disabling meeting recording or adjusting retention labels. The root cause is that the policy change alters which events Teams sends to the Microsoft 365 audit log. This article explains why the event disappears and gives you the exact steps to restore audit logging for Teams meetings.
Key Takeaways: Restoring Teams Meeting Audit Events After a Policy Change
- Microsoft Purview > Audit > Audit retention policies: Set the retention period to 180 days or 10 years to ensure meeting events are not dropped.
- Microsoft Purview > Audit > Audit settings > Turn on auditing: Verify that auditing is actually enabled for your tenant, because a policy change can turn it off.
- PowerShell cmdlet
Set-AdminAuditLogConfig: Use this cmdlet to re-enable audit logging if the portal toggle is grayed out.
Why a Compliance Policy Change Hides Teams Meeting Events from the Audit Log
The Microsoft 365 audit log records actions that are defined by the auditing schema for each workload. When an admin changes a compliance policy, the change can affect which events the service emits. For example, if you disable the “Record meetings” policy under Teams meeting policies, the service stops generating the MeetingRecordingStarted or MeetingRecordingStopped events. Similarly, if you assign a retention label that suppresses recording, the meeting event may be classified as non-auditable and never sent to the audit log.
Another common cause is that the policy change inadvertently turns off the audit log itself. In the Microsoft Purview portal, the “Turn on auditing” toggle can be disabled by a compliance policy that restricts audit log access. When the toggle is off, no new events are recorded, even if the meeting occurs. The audit log only shows events that were captured before the toggle was turned off.
Finally, the audit log has a default retention period of 90 days for most editions. If your compliance policy change also changed the retention period to a shorter duration, older meeting events may have been purged. The event is not missing because of the policy change itself, but because the retention window expired.
How Audit Events Are Generated for Teams Meetings
Teams meeting events are generated by the Teams service and sent to the Unified Audit Log. Each event has a RecordType value, such as 25 for Teams meeting events. The event includes the meeting ID, organizer, attendees, and timestamps. The audit log stores these events for a period defined by your tenant’s audit retention policy. If the policy is set to 90 days and the meeting event is older than 90 days, it will no longer appear in the audit log search results.
Steps to Restore Teams Meeting Audit Events After a Compliance Policy Change
Follow these steps in order. Each step addresses a different cause of the missing audit event.
- Verify that audit logging is enabled in Microsoft Purview
Go to Microsoft Purview > Audit > Audit settings. Check that the toggle “Turn on auditing” is set to On. If it is Off, click the toggle to turn it back on. You must be a member of the Audit Logs role to change this setting. - Check the audit retention policy
In Microsoft Purview, go to Audit > Audit retention policies. Review the retention period for the default policy. If it is set to 90 days and you need longer, change it to 180 days or 10 years. This ensures that meeting events are not purged before you search for them. - Confirm the Teams meeting policy allows recording
Open the Teams admin center and go to Meetings > Meeting policies. Select the policy applied to the meeting organizer. Under “Recording”, ensure that “Cloud recording” is set to On. If it is Off, change it to On and save. This generates recording-related audit events. - Re-trigger the meeting event
After changing the policy, ask the organizer to start a new meeting and then end it. Wait up to 24 hours for the event to appear in the audit log. Search for the event using the activity “Meeting started” or “Meeting ended” in the audit log search. - Use PowerShell to re-enable audit logging
If the toggle in the portal is grayed out, use PowerShell. Connect to Exchange Online and runSet-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true. This forces the audit log to accept new events.
How to Search the Audit Log for a Specific Meeting Event
To search for a meeting event, go to Microsoft Purview > Audit > Search. Set the date range to include the meeting time. In the “Activities” dropdown, select “Teams meetings” and choose the specific activity, such as “Meeting started” or “Meeting ended”. Then click “Search”. If no results appear, widen the date range or clear the activity filter and search by user.
If Teams Audit Log Still Does Not Show a Meeting Event
Teams Audit Log Shows No Events at All After a Policy Change
If the audit log shows no events at all, not just for meetings, the audit log is likely disabled. Go to Microsoft Purview > Audit > Audit settings and confirm the toggle is On. If it is On but still no events, check the audit log search permissions. You need the “View Audit Log” role to see events.
Meeting Event Appears but the Recording Event Is Missing
If the meeting event appears but the recording event is missing, the meeting recording policy is off. In the Teams admin center, go to Meetings > Meeting policies and enable “Cloud recording” for the policy. Then start a new recording and check the audit log.
Audit Log Search Shows “No results” for a Specific User
If the audit log search shows no results for a specific user, the user may not have a Teams license. Only licensed users generate audit events. Check the user’s license in the Microsoft 365 admin center. Also, if the user is a guest, audit events for guests are recorded only if the guest has a license.
Teams Audit Log Settings: On vs Off After a Policy Change
| Item | Audit Log On | Audit Log Off |
|---|---|---|
| Description | All Teams meeting events are captured | No new events are recorded |
| Retention | Events kept for 180 days or 10 years | Existing events kept until retention expires |
| Policy impact | Policy changes are logged | Policy changes are not logged |
| Search results | Meeting events appear in audit log | Meeting events do not appear |
After you re-enable the audit log, it may take up to 24 hours for new events to appear. The audit log is eventually consistent, so do not expect instant results. If you need immediate verification, use the PowerShell cmdlet Search-UnifiedAuditLog to query recent events.
Now you can restore audit logging for Teams meetings after a compliance policy change. Start by checking the audit toggle and retention policy in Microsoft Purview. Then adjust the Teams meeting recording policy if needed. Use the PowerShell cmdlet Set-AdminAuditLogConfig to force re-enablement if the portal is unresponsive. For advanced monitoring, set up a diagnostic alert in Microsoft Purview to notify you when audit logging is turned off.