Microsoft Demands Additional Licenses for Planner and To Do Auditing

Planner Audit Events Covered by Purview Premium Auditing Along With To Do and Project

In a development that can only be viewed as a grasping attempt to generate additional, Microsoft announced on June 16 (message center notification MC590113, Microsoft 365 roadmap item 124916) that audit events for Planner, Project, and To Do would be available in the Purview compliance policy, but only if tenants have Microsoft Purview audit (premium) licenses (included in Office 365 E5 and Microsoft 365 E5).

I don’t have any problem with Microsoft imposing premium licensing for audit events generated by Project, which isn’t a mainline application for many tenants. But Planner and To Do are general-purpose applications in widespread use, just like all the other workloads that generate audit events without additional cost, like Azure AD, Exchange Online, SharePoint Online, Teams, and so on.

What’s Can Planner Audit Events and To Do Audit Events Capture?

This is a bizarre development. Planner (Figure 1) and To Do are closely aligned with Teams and most Teams auditable events flow into the audit log without the need for additional licenses. There’s nothing especially noteworthy about the information stored in these workloads. I’m sure that some evidence exists of how people plan nefarious activities using Planner or To Do, but a glance at the auditable events for To Do or Planner doesn’t throw up much that might interest an investigator. Perhaps deleting a plan or adding a member to a roster (for a plan associated with a Loop task list or Microsoft 365 group) might be interesting, but that’s about it. Auditing To Do could be a waste of time as mostly people use this workload to note personal must-do activities.

Apart from auditing Project events, which could be worthwhile for those who want to track user interaction with project plans, the only reason I can see for Microsoft’s decision is a perceived need to add extra value to the Purview Premium Audit solution. Microsoft hasn’t expanded the high-value events like MailItemsAccessed covered by the solution for a while. Including To Do and Planner must have appeared to be a good idea, even when the captured events patently do not pass the high-value test. It’s an example of a decision that seems merited when discussed internally that rapidly fades when exposed to the harsh light of tenant administration reality.

New Solutions Come With New Licenses

We shouldn’t be surprised when Microsoft does things like this to try to drive extra revenue. Although Office 365 continues to grow past its current level of more than 382 million monthly active users, the pressure to increase the average revenue per user (ARPU) is present and is emphasized every quarter when Microsoft discusses its results with market analysts. To drive extra revenue, Microsoft must convince customers to upgrade to more expensive licenses or buy extra add-ons, like Syntex-SharePoint Advanced Management (at least that add-on has some value). The extra few dollars per user per month rapidly accumulates when operating at the scale of Microsoft 365, and that’s why we see Microsoft introduce new features governed by new licenses.

Nickel and Diming

It’s disappointing to see Microsoft try and nickel-and-dime their customers by charging for solutions with marginable value. Planner and To Do should have generated audit events long ago. The reason why the unified audit log has its name is that it’s where events captured from all workloads go. Planner and To Do aren’t special workloads. In most cases, their events are not terribly interesting. Bundling them with Project doesn’t make any sense, especially when you consider how carefully Microsoft has kept clear blue water between Project and Planner over the years.

---

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across Office 365. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what happens, why it happens, and what new features and capabilities mean for your tenant.