#purview 5 articles
"User:… dont have any permissions" from the audit query API rejects the USER, not the app gotchas / graph Consent vs. Exchange audit role; Global Admin usually inherits it, so compare accounts Purview audit objectIdFilters can return nothing — silently gotchas / graph Narrowed to one library: 0 records, no error; without the filter 1,000 records, 38 of them for that library — ask for a window, filter by object locally, A/B every server-side filter Purview audit query API — a query for a service you have no scope for still "succeeds" with 0 records gotchas / graph With only AuditLogsQuery-SharePoint.Read.All, Exchange and Entra queries return 201 → succeeded → 0 records; an unfiltered query returns only SharePoint records Sensitivity labels in SharePoint Search — the managed property works, but licensing gates it gotchas / search InformationProtectionLabelId returns a GUID only after AIP-enable + label + crawl; unlicensed tenants can't even create a label (InvalidLicenseException) The Purview Audit Query API is asynchronous — think in hours, not seconds gotchas / graph Hour-long queries; attach to the last succeeded, create in background