Internal Server Error - 500 - Graph Beta auditLogQuery

Question

I receive (both from Graph Explorer and Powershell 7) the error: Internal Server Error - 500 when run a POST to create an auditLogQuery search:

To Reproduce:

1. Go to https://developer.microsoft.com/en-us/graph/graph-explorer
2. Select 'POST' and beta
3. Search https://graph.microsoft.com/beta/security/auditLog/queries
4. Put Request body: { "displayName": "Audit Search 06-Dec-2024 09:51", "filterStartDateTime": "2024-11-06T00:00:00.000Z", "filterEndDateTime": "2024-12-06T00:00:00.000Z", "operationFilters": [ "filepreviewed", "filedownloaded", "fileaccessed" ] }

From Powershell 7.4.6 with Microsoft.GraphBeta:

New-MgBetaSecurityAuditLogQuery_Create: Internal Server Error

Status: 500 (InternalServerError)

ErrorCode:

Date: 2025-01-15T13:26:28

Headers:

Cache-Control : no-cache

Vary : Accept-Encoding

Strict-Transport-Security : max-age=31536000

request-id : 222c0bd5-7149-4f6c-8eaf-9ec4039c1a2c

client-request-id : 0eced7f4-dd0c-477a-b2b1-ae71b503d2a0

x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"Switzerland North","Slice":"E","Ring":"3","ScaleUnit":"000","RoleInstance":"ZR1PEPF00000663"}}

Date : Wed, 15 Jan 2025 13:26:28 GMT

Attached from Graph Explorer.

Permission AuditLogsQuery.Read.All assigned.

You have the same issue?

Answer 1

Hello 73708890,

Thank you for contacting Microsoft!

I have tried replicating the issue, but it was working as expected and below is the screenshot for reference.

Usually, it is not recommended to use the Beta versions of API in production as they are subject to change according to Microsoft policies and they can be leveraged only when they are available for general use.

For the 500 internal server error, we recommend you retry the operation after some time as it might be due to a temporary server glitch.

If you still face the issue even after retrying, I recommend you to raise a support case with Microsoft, a Support Engineer will be able to look into this issue and assist you better. You can raise support ticket from New support request - Microsoft Entra admin center or https://admin.microsoft.com/#/support/requests.

Hope this helps.

If the answer is helpful, please click Accept Answer and kindly upvote it. If you have any further questions about this answer, please click Comment.

Answer 2

Hello @Akhil Nasalwai - MSFT

Seems that now is working, but the Audit search is not visible in PureView Portal and seems tuck in notStarted status.

VERBOSE: GET https://graph.microsoft.com/beta/security/auditLog/queries/660c6c31-9d80-4d79-8630-d97f233b401c with 0-byte payload

DEBUG: GET /beta/security/auditLog/queries/660c6c31-9d80-4d79-8630-d97f233b401c HTTP/1.1

HTTP: graph.microsoft.com

User-Agent: Mozilla/5.0 (Windows NT 10.0; Microsoft Windows 10.0.14393; en-US) PowerShell/7.4.6 Invoke-MgGraphRequest

VERBOSE: received 666-byte response of content type application/json

DEBUG: GET https://graph.microsoft.com/beta/security/auditLog/queries/660c6c31-9d80-4d79-8630-d97f233b401c

HTTP/2.0 200 OK

Cache-Control: no-cache

Vary: Accept-Encoding

Strict-Transport-Security: max-age=31536000

request-id: 44fca277-c57f-4fac-94ed-747e9343ed71

client-request-id: c4f6605e-4556-4210-ac94-5cc9d07293d6

x-ms-ags-diagnostic: {"ServerInfo":{"DataCenter":"Switzerland North","Slice":"E","Ring":"3","ScaleUnit":"000","RoleInstance":"ZR1PEPF00000756"}}

odata-version: 4.0

Date: Thu, 23 Jan 2025 11:44:56 GMT

Content-Type: application/json; odata.metadata=minimal; odata.streaming=true; IEEE754Compatible=false; charset=utf-8

Content-Encoding: gzip

{"@odata.context":"https://graph.microsoft.com/beta/$metadata#security/auditLog/queries/$entity","id":"660c6c31-9d80-4d79-8630-d97f233b401c","displayName":"Audit Search Sharepoint 23-Jan-2025 12:44","filterStartDateTime":"2025-01-16T12:44:24.737Z","filterEndDateTime":"2025-01-23T12:44:24.83Z","recordTypeFilters":["SharePointFileOperation"],"keywordFilter":null,"serviceFilters":[],"operationFilters":["fileaccessed","filedownloaded","filepreviewed"],"userPrincipalNameFilters":[],"ipAddressFilters":[],"objectIdFilters":["https://XXXXXXXXXXX.sharepoint.com/sites/XXXXXXXXXXX"],"administrativeUnitIdFilters":[],"status":"notStarted"}

I have a script that check every 30 second the status, but the status is always notStatus after also few hours:

Waiting for audit search to complete. Check 125 after 3690 seconds. Current state notStarted

Waiting for audit search to complete. Check 126 after 3720 seconds. Current state notStarted

Waiting for audit search to complete. Check 127 after 3750 seconds. Current state notStarted

Waiting for audit search to complete. Check 128 after 3780 seconds. Current state notStarted

Waiting for audit search to complete. Check 129 after 3810 seconds. Current state notStarted

Waiting for audit search to complete. Check 130 after 3840 seconds. Current state notStarted