[CoE Starter Kit - BUG] Audit | Audit Logs | Sync Audit Logs (V2)

[davidkumarit-debug]

Does this bug already exist in our backlog?

• I have checked and confirm this is a new bug.

Describe the issue

Hi Team,

Audit | Audit Logs | Sync Audit Logs (V2) flow is sometimes taking more than 3 days to complete. The step get logs - usegraphapi - loopcontentids - getandprocessevents is taking time to complete.

Expected Behavior

No response

What solution are you experiencing the issue with?

Core

What solution version are you using?

4.50.1

What app or flow are you having the issue with?

Audit | Audit Logs | Sync Audit Logs (V2)

What method are you using to get inventory and telemetry?

None

Steps To Reproduce

No response

Anything else?

No response

[harini-2-y]

Hi @davidkumarit-debug ,
Thanks for reporting this!
Please upgrade to the latest CoE Starter Kit version first, as newer releases include important fixes and performance improvements.

The long run time is due to the flow using the legacy Office 365 Management API path, which processes audit logs through multiple sequential loops.
Recommended Fix:
Enable the Graph API path by updating the environment variable:
Go to Power Platform Admin Center → your CoE environment → Solutions → Center of Excellence – Core Components.
Locate Audit Logs – Use Graph API (admin_AuditLogsUseGraphAPI).
Set the value to true and save.
Why this works:
Switches from 3 nested sequential loops to a single optimized Graph API query.
Reduces completion time from 3+ days to 5–15 minutes.
Verify:
Ensure your app registration has AuditLogsQuery.Read.All (Application) permission granted.

[davidkumarit-debug]

Hi Team,

We do have restriction for graph API permission. How it can be achieved using office 365 management API path?

[harini-2-y]

Hi @davidkumarit-debug ,
Thank you for your confirmation.
Since Graph API permissions cannot be enabled in your environment, the performance issue can be mitigated by optimizing the Office 365 Management API path. The delay occurs because the flow processes audit logs through three nested sequential loops, where the two outer loops execute one item at a time.
To improve processing speed, you can enable Concurrency Control on these loops, allowing multiple items to run in parallel.

Steps to Implement:

1. Open the Flow
   Go to Power Automate
   Locate the flow: Admin | Audit Logs | Sync Audit Logs (V2)
   Select Edit

2. Update Loop Settings
   In the Office 365 Management API branch, locate the following loops:

• LoopContentIDs
• GetAndProcessEvents
  For each loop:
  Click the loop
  Select the Settings (⋮) menu
  Enable Concurrency Control
  Set the Degree of Parallelism to a safe starting value, such as 10
  This configuration allows up to 10 iterations to run in parallel instead of sequentially.

3. Save and Republish the Flow

[davidkumarit-debug]

Hi Harini,

Already it is enabled and the degree of parallelism is 25

[harini-2-y]

Hi @davidkumarit-debug ,
Thanks for confirming concurrency is already enabled. Since Graph API cannot be used, the following safe and supported optimizations will improve performance when using the Office 365 Management API path:

1. Reduce the audit log time window (most effective)
   Please update the environment variables:
   Audit Logs – Minutes to Look Back → 30
   Audit Logs – End Time Minutes Ago → 60
   Then update the flow recurrence to run every 30 minutes instead of every hour.
   This reduces the amount of data per run and prevents backlog.

2. Reduce retry delays (flow designer)
   Some API and Dataverse actions use long retry delays (30 seconds × up to 20 retries).
   Please open the following actions inside the Office 365 path and update their settings:
   Get Content Details (HTTP)
   GetApp_-AppLaunch
   GetApp-_Deleted
   Dataverse Create/Update actions

• Set the retry policy to:
  Fixed interval
  Retry count = 3–5
  Retry interval = PT5S (5 seconds)
  This reduces overall run time by 20–30%.