Audit Logs - You do not have access

Question

Audit Logs - You do not have access

Erick Sanchez 20

Got the following warning when trying to access the Audit log from Monitoring & Health menu.

{"sessionId":"37fe23bc011d4662b582ad7cfae70f4a","subscriptionId":"","resourceGroup":"","errorCode":"401","resourceName":"","details":"Error loading your content"}

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Hey Erick, that 401 (“Unauthorized”) message means you don’t currently have permission to load the audit data. A few things to check:

Your Azure AD role • To view Entra Audit logs in the portal you need one of these directory roles: – Global Administrator – Security Administrator – Security Reader – Reports Reader • If you’re a guest user, you can’t view the tenant’s audit logs by default.
Your license level • Audit logs in the Entra portal are available in all editions, but if you’re trying to surface Entra logs through Azure Monitor (or the Activity log in the Azure subscription blade), you must have at least an Entra ID P1 or P2 license.
Where you’re looking • If you navigated to Azure Monitor > Activity log, you’ll only see logs for ARM resources. Entra audit logs live under Microsoft Entra (older “Azure Active Directory”) > Monitoring & Health > Audit logs.
Diagnostic settings (only if your goal is to route logs into a Storage Account, Event Hub, or Log Analytics) • You must explicitly configure Diagnostic Settings on “Microsoft Entra ID” in the Azure portal. There is no backfill, so you’ll only see events after the setting was in place.

Next steps

• Verify your directory role and upgrade or request the needed role if you don’t have it.

• Confirm you’re in the Entra portal’s Audit logs blade versus the Azure Monitor Activity log.

• If you’re routing logs to Azure Monitor, make sure diagnostic settings are enabled on the “Microsoft Entra ID” resource.

Let me know:

• Which blade you clicked to get this error?

• What directory role and license you have?

• Whether you’re a “Member” or “Guest” in this tenant?

— Reference docs

• Audit log activities: https://learn.microsoft.com/entra/identity/monitoring-health/reference-audit-activities

• Entra logs in Azure Monitor troubleshooting: https://docs.microsoft.com/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor

• Entra licensing and roles requirements: https://learn.microsoft.com/entra/fundamentals/get-started-premium

Note: This content was drafted with the help of an AI system. Please verify the information before relying on it for decision-making. Hello @Erick Sanchez ]

If the resolution was helpful, kindly take a moment to click on and click on Yes for was this answer helpful. And, if you have any further query do let us know.

Erick Sanchez 20 Reputation points

2026-06-02T17:48:27.0133333+00:00

@Rukmini thanks for your help. I went back again after a few minute and this times it showed some entries. However, we don't have only P1 for two users in the executive level, the rest are only MS365 Premium. In any case, your entry will help me in a future query to understand what it needed to be done to collect data from Entra ID to Azure. Thanks again for your help, much appreciated.
Rukmini 43,995 Reputation points Microsoft External Staff Moderator

2026-06-02T17:51:52.6633333+00:00

Hello @Erick Sanchez ]

If the resolution was helpful, kindly take a moment to click on and click on Yes for was this answer helpful. And, if you have any further query do let us know.