It’s possible. In this case, it didn’t affect one environment because it didn’t affect the service account that is writing those MRP logs. One account can apparently write the MRP log files without creating masses and masses of audit events, but the other account - which we thought was ‘identical’ - is somehow different. I’ll post some screenshots later - I’ll just anonymise them first.
If you’re not seeing those audit events, that’s good! But it’s good to KNOW that’s the case.
This is a very current investigation, so I’ll update as I find out more. Right now, I don’t even know what makes the two accounts different.