ErrorSharePoint Online Audit Service

Products Activity Monitor Discussions & Questions
,
1

I use Netwrix Auditor. I have a monitoring plan for SharePoint Online. For the past few days, I have been receiving several instances of this error:

  • Source: SharePoint Online Audit Service

  • Event ID: 3228

  • Computer: server. myaddomain. org

  • Description: Monitoring plan: MP - SharePoint

  • Item: mydomain. onmicrosoft. com

  • Message: State-in-time data collected partially: Failed to collect state-in-time snapshot data for site collection https://mydomain-my.sharepoint.com/personal/user_mydomain_onmicrosoft_com due to the following error: Error get response for GetSite: The access to the website has been blocked. To resolve the issue, contact the administrator.

The users triggering this error were all deleted or unlicensed several years ago.

Why does Netwrix continue to see OneDrive sites for users deleted years ago (or those whose licenses were removed), and more importantly, why is it throwing an error?

2

Same here. Seeing the same on multiple customer environments.

3

Have you found a solution?
For me, exactly since April 28.
And it affects SOME “deleted” users (not all) and 2 in “production”.
And the error occurs at night, during snapshot creation: “Failed to collect state-in-time snapshot data for site collection”

4

No!
I was hoping for a response from Netwrix, but I see there isn’t one.

5

Hi everyone,

Thank you for reporting this — we’re aware of the issue.

The errors you’re seeing (Event ID 3228, “The access to the website has been blocked”) are related to ongoing changes on the Microsoft side that affect how handles access to OneDrive site collections belonging to deleted. These sites are still enumerated by SharePoint APIs, but access to them is being blocked — hence the partial state-in-time data error.

We are working on a fix for this issue.

In the meantime, the recommended workaround is to exclude the affected site collections using the OmitSitScStoreList.txt file. Add the URLs of the problematic sites to the file and сollector will skip them.

We’ll update this thread once the fix is available. Apologies for the inconvenience.