On November 13, 2025, Microsoft briefly changed the user ID in the Office 365 audit feed to all lowercase. For users whose usernames contain capital letters, Fluency saw the lowercase name as a new user, so O365_AzureAD_UserLoggedIn and other rules that key on the field raised false positives.
No action is needed. Alerts raised during that window for this reason can be closed as false positives.
If your Google Workspace integration shows administrator events but no user activity — no sign-ins, no Drive or Gmail events — the cause is an access setting in your Google Admin console, not in Fluency. Google sends only administrator events to a third-party app whose access is left at Limited.
The certificate Fluency uses to receive syslog over TLS changes on August 8, 2024. Devices and syslog servers that send syslog over TLS directly to Fluency may need to be updated to keep sending. Sites that send through a Fluency Collector are not affected.
If you send syslog over TLS directly to Fluency, contact Fluency Support for the details and the updated certificate.