App/Workspace Name Changed in Audit Logs

[MitchM]

Hi, I am not sure where the best place to put this i,b butI am hoping someone has an answer. We export Audit logs weekly from the O365 Admin Portal to measure global usage of PowerBI. We noticed that in the last few weeks almomst all App/Workspace names in AuditData.Workspace name is now showing as "Donald". No matter what report it is, or what App/Workspace it is in, it is showing Donald. Can anyone shed some light on this?

[v-jiascu-msft]

Hi @MitchM,

How did you export logs? Please refer to the snapshot below. It's good.

Best Regards,
Dale

[MitchM]

Hi Dale,

     sorry for the delay, we needed to test some thing out. This is not the issue we are seeing. All of the reports are in previously published, and used apps and are still being viewed in those Apps (none of which are named "Donald"). The change of the App/Workspace from the real Space name to "Donald" with the Activty type "Viewed in App" is very troubling to us as by definition I would think that "Audit Logs" should be trustworthy data. We are going to escalate this to our Microsoft representative as it has raised security concerns. 

Regards

[v-jiascu-msft]

Hi @MitchM,

Can you share the results or the solutions, please?

Best Regards,
Dale

[tomlinse]

@MitchM I am inteterested in this as well. Experiencing something similar at my organization.

[v-jiascu-msft]

Hi @MitchM,

OK, I will appreciate if you can share the result here when you get it.

Best Regards,
Dale