[CoE Starter Kit - BUG] ParseEvents in Admin | Audit Logs | Sync Audit Logs (V2) flow fails due to null UserId

[Jithin5581]

Does this bug already exist in our backlog?

• I have checked and confirm this is a new bug.

Describe the issue

After upgrading to the Jan 2024 COE Starter Toolkit, I see that the flow "Admin | Audit Logs | Sync Audit Logs (V2)" fails intermittently when it tries to ParseEvents returned from the Office Management API and encounters an object that has a null value for the UserId.

I am not exactly sure why the UserId=null and not a valid emailaddress since the UserKey property points to an active user profile in our directory. Unfortunately, this cause the flow to fail about three to four times in a day.

I have included the screenshots and object in question (redacting the tenant info):

In the payload below, UserKey in both these consecutive objects is the same but UserId is null for the second object only.

Expected Behavior

I am not familiar enough with the Office 365 Management APIs to know if this is a known issue but can we update the flow to account for this?

What solution are you experiencing the issue with?

Audit Log

What solution version are you using?

4.22

What app or flow are you having the issue with?

Admin | Audit Logs | Sync Audit Logs (V2)

What method are you using to get inventory and telemetry?

Cloud flows

Steps To Reproduce

1. Used a Production Environment.
2. Upgraded the solution to Jan 2024 release.
3. Followed the "COE Admin Center App" before the upgrade to ensure no unmanaged solution layers are present and "COE Setup and Upgrade Wizard" after the upgrade to confirm solution configuration.
4. PowerPlatform Admin group receives the error email with subject "Admin | Sync Flow Errors" which points to the errored out runs for the "Admin | Audit Logs | Sync Audit Logs (V2)" flow.

Anything else?

No response

AB#2234

[Jenefer-Monroe]

Thank you so much for sending the details, I would not have been able to see what was happening here without your help as I don't have a repro locally.
Yes it looks like some operation unrelated to us sometimes sends null there.
Can you test by putting the below Schema in the Schema section of ParseEvents? And see if you repro again.

{
    "type": "array",
    "items": {
        "type": "object",
        "properties": {
            "CreationTime": {
                "type": "string"
            },
            "Id": {
                "type": "string"
            },
            "Operation": {
                "type": "string"
            },
            "Workload": {
                "type": "string"
            },
            "AppName": {
                "type": "string"
            },
            "ObjectId": {
                "type": [
                    "string",
                    "null"
                ]
            },
            "UserId": {
                "type": [
                    "string",
                    "null"
                ]
            },
            "UserKey": {
                "type": [
                    "string",
                    "null"
                ]
            }
        }
    }
}

[Jithin5581]

I have updated the flow on my end and will report back in a day or two on whether the flow runs without errors. Thank you.

[Jithin5581]

Happy to report that I don't see an error logged since 9th Feb on the flow. Thanks Jenefer.

[Jenefer-Monroe]

Wonderful! I'll go ahead and mark this as a bug fixed for the March release.
Thank you for the great debugging and helping me test!