Forum Discussion

DaithiG's avatar
DaithiG
Steel Contributor
Mar 06, 2025

Office 365 API - Subscription

Hi,

We have been using the Office 365 API to send events to our SIEM for a number of months.


Since Monday we have received the following error:

AF20023","message":"The subscription was disabled

I've looked at "https://learn.microsoft.com/en-us/office/office-365-management-api/troubleshooting-the-office-365-management-activity-api#enable-unified-audit-logging-in-office-365" but even if I try and start a subscription, it will still return that it is disabled?

Not entirely sure what else I can check. 

api
office 365
  • firatkutay's avatar
    firatkutay
    Copper Contributor
    Mar 06, 2025

    Hi,

    The error code AF20023 ("The subscription was disabled") can be tricky to resolve, but here are some steps you can try to troubleshoot and potentially fix the issue:

    1. Check Subscription Status: Use the API endpoint to list your subscriptions and verify their status. You can do this with the following command:

    Invoke-WebRequest -Headers $headerParams -Uri "https://manage.office.com/api/v1.0/<TenantGUID>/activity/feed/subscriptions/list"

    Replace <TenantGUID> with your tenant's GUID. This will show whether the subscription is active or disabled.

    2. Recreate the Subscription: If the subscription is disabled, try deleting it and creating a new one. Use the following command to start a new subscription:

    Invoke-WebRequest -Method Post -Headers $headerParams -Uri "https://manage.office.com/api/v1.0/<TenantGUID>/activity/feed/subscriptions/start?contentType=Audit.General"

    Replace Audit.General with the appropriate content type for your use case.

    3. Unified Audit Logging: Ensure that Unified Audit Logging is enabled for your tenant. You can check this in the Microsoft 365 compliance center or by running the following PowerShell command:

    Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true

    4. Permissions and Admin Role: Verify that the account you're using has the necessary permissions. The error message indicates that the subscription might have been disabled by a tenant or service admin. Ensure that your account has the appropriate admin roles.

    5. API Token and Certificate: Check if the API token or certificate used for authentication has expired. Renew them if necessary.

    6. Microsoft Support: If the issue persists, consider reaching out to Microsoft Support for further assistance. They can help investigate tenant-specific issues.

    Let me know if you'd like help with any of these steps!

Resources