When you search the Teams admin center audit log for a meeting event and find nothing, your compliance and security review hits a dead end. This problem usually stems from missing audit log licensing, incorrect search filters, or a delay in log propagation. In this article, you will learn the exact steps to locate the missing meeting event and restore full audit visibility.
The audit log in Microsoft 365 records Teams meeting activities such as meeting created, meeting updated, and meeting ended. If these events do not appear, the root cause is often a licensing gap or an improperly configured search. This guide walks you through verifying prerequisites, running a correct audit search, and resolving common failure patterns.
Key Takeaways: Restore Missing Teams Meeting Audit Events
- Microsoft 365 admin center > Billing > Licenses: Verify that the user or admin has an E5 license or the Microsoft 365 E5 Compliance add-on to enable audit logging.
- Microsoft 365 admin center > Audit > Search: Select the correct date range and activity list to capture Teams meeting events that may be hidden by default.
- Microsoft 365 admin center > Audit > Audit retention policies: Check if a custom retention policy is shortening the audit log retention period and deleting older events.
Why the Teams Audit Log Does Not Show Meeting Events
The audit log in the Teams admin center is a filtered view of the unified audit log in Microsoft 365 Purview. Meeting events such as MeetingCreated, MeetingUpdated, and MeetingEnded are generated by the Teams service and sent to the unified audit log. However, several conditions can prevent these events from appearing in your search results.
Audit Log Licensing Requirements
Only users with a Microsoft 365 E5 license, a Microsoft 365 E5 Compliance add-on, or an equivalent license can generate audit log records. If the meeting organizer or the admin performing the search does not hold one of these licenses, the audit log will not record their activities. Without the proper license, the audit log remains empty for those users.
Search Filter and Date Range Issues
The audit search tool defaults to a 90-day window and a predefined list of activities. If you search for a meeting that occurred more than 90 days ago, you must specify a custom date range. Additionally, the activity list may not include the specific Teams meeting event you need. You must select the correct activity from the list or search by user and date only.
Audit Log Propagation Delay
Audit events can take up to 24 hours to appear in the audit log after the meeting occurs. If you search immediately after a meeting, the event may not yet be available. This delay is normal and does not indicate a failure.
Steps to Diagnose and Fix Missing Teams Meeting Audit Events
Follow these steps in order to identify and resolve the issue. Each step addresses a common cause.
- Verify audit log licensing for the involved users
Go to Microsoft 365 admin center > Billing > Licenses. Check that the meeting organizer and the admin who needs to view the audit log have a Microsoft 365 E5 license or the Microsoft 365 E5 Compliance add-on. If not, assign the license or use a different account with the required license. - Enable audit log search in Purview
Go to Microsoft Purview > Audit. If the audit log search is not enabled, you will see a prompt to start recording user and admin activity. Click Start recording. This step is mandatory for new tenants. - Run a broad audit search with a custom date range
In Microsoft Purview > Audit, click Search. Clear the Activities list to search all events. Set the Start date and End date to cover the meeting time, including the propagation delay window. Enter the meeting organizer’s user principal name in the Users field. Click Search. - Filter the results for Teams meeting activities
After the search completes, use the Activity filter on the results page. Type Meeting in the filter box and select records that start with Meeting. Look for MeetingCreated, MeetingUpdated, MeetingEnded, or MeetingParticipantDetail. If these appear, the audit log is working correctly. - Check audit log retention policies
Go to Microsoft Purview > Audit > Audit retention policies. Review the default policy and any custom policies. If a custom policy retains logs for fewer than 90 days, older meeting events may be purged. Extend the retention period or adjust the policy to include the meeting date. - Test with a new meeting to confirm logging
Schedule a new Teams meeting with the same organizer. After 24 hours, search the audit log for that meeting. If the new meeting appears, the original meeting may have occurred before audit logging was enabled or before the license was assigned.
If Teams Audit Log Still Has Issues After the Main Fix
Teams Audit Log Shows No Results for a Specific Meeting
If the broad search returns no events for a meeting that occurred after you enabled audit logging, the meeting may have been created by a user without the required license. Check the meeting organizer’s license assignment. Also confirm that the meeting was not a channel meeting in a private channel, which may have separate audit settings.
Teams Audit Log Shows Only Some Meeting Events
Missing individual events such as MeetingParticipantDetail can happen when the organizer does not have the required license or when the meeting is a PSTN conference. Verify the license and run the search again. If the issue persists, use the Audit log search API to query the same date range and compare results.
Teams Admin Center Audit Page Shows an Error
If the audit page in the Teams admin center displays an error, the unified audit log may be disabled. Go to Microsoft Purview > Audit and confirm that audit log search is enabled. If it is disabled, click Start recording. Wait 24 hours before retrying.
Teams Admin Center Audit vs Microsoft Purview Audit: Key Differences
| Item | Teams Admin Center Audit | Microsoft Purview Audit |
|---|---|---|
| Access path | Teams admin center > Audit | Microsoft Purview > Audit |
| Activity filter | Limited to Teams-specific activities | All Microsoft 365 activities |
| Date range | Default 90 days | Custom range up to 1 year with E5 license |
| Export capability | CSV export available | CSV export and API access |
The Teams admin center audit page is a filtered view of the same data in Microsoft Purview. For complete search and export options, use Microsoft Purview directly.
You can now verify licensing, enable audit logging, and run a correct search to find missing Teams meeting events. Start by checking the license of the meeting organizer, then use Microsoft Purview with a broad date range. For ongoing compliance, set up an audit log retention policy that matches your organization’s requirements. As an advanced step, use the Audit log search API to automate weekly exports of Teams meeting activity.