Over the last week or so, I was working on an article about some issues with the Azure AD Audit log for Practical 365. I was actually worried that I am being too harsh and toned down my criticism a bit before sending the article for publishing. In an ironic turn of events, earlier today Tony asked me to look into something, which led me to perform another query against the Unified Audit log, this time via the Compliance Center UI. A new version of the UI was available, and it’s… something.
At first glance, the set of UI controls has been rearranged a bit, which led me to believe that Microsoft has addressed one of my biggest issues with the previous version of the UI – the amount of results visible on the page. That might well be the case, but boy oh boy, were my expectations high…
Before addressing the issues with viewing results, let’s briefly talk about the Activities dropdown and the missing View all activities button. Actually what’s there to talk about. While previously we had an easy method to bulk select/unselect all events for a given workload or reset the search filter altogether, those are now gone, as is the right-hand pane it brought. Your only option now is to use the insanely long list of events in the Activities dropdown, but hey, at least they left it searchable!
And there is a small issue with the date selection controls. The selection for the End date defaults to today, and as the time selection defaults to 00:00, this means that no events from today will actually be included in the results. So if you want to include those, make sure to update the End date to tomorrow’s value (which at least is selectable).
Next, onto the results experience, which now has its own page. Which is great for the task of reviewing the results, I give you that. What about all that white space we pointed to above, you ask? Oh, well. Probably a good place to fit an ad banner or two 🙂
Using the results page doesn’t bring a better taste either. Look at that title. I mean, look at it. How on Earth can something like this make it pass testing, QA or whatever excuse for quality control they have? How?
Next, when you select a given result, you are still presented with additional event properties in the Detail right-hand pane. The layout here has been updated to present both the properties and their values on new line each, instead of the previous property:value format (on the same line). Given the width of said pane, a better solution would be to simply resize it, at least to the width of the same pane within good old SCC. Oh well…
Oh, but it gets even better. Once you end up on the results page, you cannot view or modify the search query anymore. Because that’s how searches against the Unified Audit log work, right? You enter the exact set of criteria on your first try and never look back. In the minds of some dev or PM that is, definitely not in the mind of anyone that actually uses this functionality. Of course, getting back to the Audit page resets the UI controls. And god forbids Microsoft listens to feedback and adds the saved searches/templates functionality here! At least you can now copy/paste a query’s URL and do that yourself…
Filtering is also gone. Who needed that anyway. I can’t even with these folks anymore. This is either someone’s spare time side project, or they deliberately released some half-baked preview version without even giving you the option to switch to the old experience. At least the good old SCC UI is still available… for now.
Yikes indeed..