I have validated the audit logs in multiple places outside my organization and it has worked fine, I am suspecting something to do with Azure AD setup. Test decoding your access token and see the content using https://jwt.io Look at "upn" or "unique_name" properites in the decoded token, if they show GUID instead of names it would be an indicator that Azure AD setup is causing this to happen.