Microsoft Drops Office 365 Auditing for Sway

Sway Hasn’t Progressed as Hoped Since 2015

Sway, or as it was in those days “Office Sway,” made its debut at the Microsoft Ignite 2015 conference with the tagline “reimagine how your ideas come to life.” Generally available since August 2015, it’s clear that Sway has not achieved the kind of breakthrough that Microsoft hoped at the time.

Perhaps it’s because the Office community is too embedded in PowerPoint to want to change to a new tool. PowerPoint has received its own batch of improvements since 2015, including design ideas, and shows no sign of losing popularity. Sway certainly hasn’t dented the PowerPoint juggernaut. Due to pressure of space and the need to make room for more popular topics, we moved coverage of Sway to the companion volume of the Office 365 for IT Pros eBook in 2018.

No More Sway Audit Events

Microsoft posted Office 365 notification MC220283 on August 12 saying: “Effective immediately, we have retired support for organizations to audit Sway activities via the Microsoft 365 admin center.” In other words, the Sway application no longer generates audit events for ingestion into the Office 365 audit log.

Because the audit events aren’t in the log, administrators can’t search the log using the Audit log search option in the Compliance Center or with the Search-UnifiedAuditLog cmdlet for events like SwayCreate, SwayDelete, SwayEdit, or SwayShare. I tested if the change was effective as stated by working with several Sways in my tenant and sure enough, nothing appeared in the audit log.

Who Uses Sway?

On the surface, this isn’t a huge deal. Anecdotal evidence is that Sway isn’t used much in Office 365 tenants, especially those with the necessary E3 and E5 licenses needed for auditing. I hear that Sway gets more use in tenants with academic licenses, but if users don’t have the required licenses, there’s no point in Sway generating audit events.

Only Microsoft knows why they have broken the link between Sway and the audit log. Generating audit events is hardly a massive overhead for Sway and the ingestion of those events into the audit log shouldn’t pose any strain on the service. After all, the number of potential Sway events is a minor fraction of the billions created for SharePoint Online, which is the most verbose of all workloads in terms of audit events.

It’s possible that Microsoft’s much-loved (by Microsoft) telemetry indicates that tenants seldom search for Sway audit events and that this factor might have driven the decision. No one except Microsoft really knows why as the notification delivers a remarkable lack of explanation.

The Real Problem

Not many will miss the loss of Sway audit events. What’s more perturbing is Microsoft’s announcement of the deprecation without warning. In MC220283, Microsoft “apologize for the delayed notice and are working to ensure we provide timely guidance in the future.” The notice wasn’t delayed. It was given after Sway stopping generating events and that’s not good enough when it comes to compliance features which tenants might rely upon.

In this case, the damage is minimal and the worse thing is probably the need to update documentation. The question is whether Microsoft might withdraw a more popular feature with the same lack of up-front communication and detailed explanation in the future. Let’s hope that they don’t.