Microsoft Graph Audit Log Query Issue in Beta (Stuck in ‘notStarted/running’) and v1.0 Endpoint Returning ‘Resource Not Found’

I created an audit log query using the Microsoft Graph API (beta). However, when I repeatedly check the query status, it remains in ‘notStarted’ or ‘running’ state and does not transition to ‘succeeded’, ‘failed’, ‘cancelled’, or ‘unknownFutureValue’, even after waiting for some time. Could you help identify the reason for I created an audit log query using the Microsoft Graph API (beta). When I check the query status, it consistently remains in ‘notStarted’ or ‘running’ state and does not transition to ‘succeeded’, ‘failed’, ‘cancelled’, or ‘unknownFutureValue’, even after some time. This is not due to multiple requests, as only a single query was created. Could you help identify the cause of this behavior?

POST https://graph.microsoft.com/beta/security/auditLog/queries

{

"@odata.type": "#microsoft.graph.security.auditLogQuery",

"displayName": "Test Query One Hour",

"filterStartDateTime": "2026-04-15T00:00:00Z",

"filterEndDateTime": "2026-04-15T01:00:00Z",

"recordTypeFilters": ["azureActiveDirectory"]

}

GET https://graph.microsoft.com/beta/security/auditLog/queries/{auditLogQueryId}

GET https://graph.microsoft.com/beta/security/auditLog/queries/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

{

"@odata.context": "https://graph.microsoft.com/beta/$metadata#security/auditLog/queries/$entity",

"@microsoft.graph.tips": "Use $select to choose only the properties your app needs, as this can lead to performance    improvements. For example: GET security/auditLog/queries('<guid>')?$select=administrativeUnitIdFilters,displayName",

"id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",

"displayName": "Test Query One Hour",

"filterStartDateTime": "2026-04-15T00:00:00Z",                            

"filterEndDateTime": "2026-04-15T01:00:00Z",

"recordTypeFilters": [

    "AzureActiveDirectory"

],

"keywordFilter": null,

"serviceFilters": [],

"operationFilters": [],

"userPrincipalNameFilters": [],

"ipAddressFilters": [],

"objectIdFilters": [],

"administrativeUnitIdFilters": [],

"status": "notStarted"

}

I also attempted to use the v1.0 endpoint, but I encountered a ‘BadRequest’ error stating ‘Resource not found for the segment auditLog’. Could you please clarify whether this API is supported in v1.0 or only available in beta?

POST https://graph.microsoft.com/v1.0/security/auditLog/queries

GET https://graph.microsoft.com/v1.0/security/auditLog/queries/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

{

"error": {

    "code": "BadRequest",

    "message": "Resource not found for the segment 'auditLog'.",

    "innerError": {

        "date": "2026-04-29T07:07:55",

        "request-id": "73e78731-4c54-4686-8f06-50c4dad342a5",

        "client-request-id": "68a29615-6686-85c7-c991-0c57b860bfd1"

    }

}

}