On December 12, Microsoft said that they want to make the Search-UnifiedAuditLog cmdlet use high completeness for all its searches. The result is a disaster.

On December 12, Microsoft said that they want to make the Search-UnifiedAuditLog cmdlet use high completeness for all its searches. The result is a disaster.

On December 12, Microsoft said that they want to make the Search-UnifiedAuditLog cmdlet use high completeness for all its searches. The result is a disaster.

The advent of the MoreRecordsAvailable property gives the Search-UnifiedAuditLog more precise control over fetching large numbers of audit records.

YouTube video by The Infographics Show

**[Introduction]** To improve performance and provide better visibility into query progress, we are updating the behavior of the **ResultCount** parameter for the **Search-UnifiedAuditLog cmdlet** in _Microsoft Purview Audit_. Previously, the **ResultCount** parameter returned the total number of results expected from a query. With this update, **ResultCount** **will display a running count of results** as they are retrieved in _real time_. We are also introducing a new boolean property, **AuditSearchRequestMetadata.moreRecordsAvailable** , which indicates whether additional records are still being retrieved. Together, these updates provide administrators with improved transparency into audit log search progress and better support for script and automation scenarios. **[When this will happen]** * **General Availability (Worldwide, GCC):** We began rolling out in **mid-May 2026** and expect to complete by**late May 2026**. * **General Availability (GCC High, DoD):** We will begin rolling out in **early June 2026** and expect to complete by **late June 2026**. **[How this affects your organization]** _Who is affected_ * Administrators who use **Microsoft Purview Audit** * Administrators running the **Search-UnifiedAuditLog cmdlet** in _PowerShell_ * Organizations with**scripts or automation that rely on audit log search results** _What will happen_ * The **ResultCount parameter** will now display a running count of results as they are retrieved during query execution. * A new boolean property, **AuditSearchRequestMetadata.moreRecordsAvailable** , will indicate whether additional records are still being retrieved. * While the query is running: * **ResultCount** shows the number of records retrieved so far. * **moreRecordsAvailable** is set to **_true_**. * When the query completes: * **ResultCount** reflects the final total number of results. * **moreRecordsAvailable** is set to **_false_**. * This feature is **enabled by default**. * There is no change to audit log data or retention. * Existing scripts that rely on **ResultCount** representing a final total before completion may require updates. **[What you can do to prepare]** * Review existing scripts and automation that rely on **ResultCount** to determine total results. * Update scripts to use **AuditSearchRequestMetadata.moreRecordsAvailable** to confirm when queries are complete. * Adjust pagination or query logic to incorporate a check for **AuditSearchRequestMetadata.moreRecordsAvailable** to reliably determine whether more records remain. * Test audit log searches and automation during the rollout window from **mid-May through late May 2026**. * If you run **Search-UnifiedAuditLog** manually in _PowerShell_ and review results interactively, no changes are needed. You will benefit from improved real-time progress visibility. **Learn more:** * Learn about auditing solutions in Microsoft Purview | Microsoft Purview | Microsoft Learn * Search-UnifiedAuditLog | policy-and-compliance-audit | ExchangePowerShell | Microsoft Learn _If you have questions or need assistance, contact Microsoft Support._ **[Compliance considerations]** **Question**| **Answer** ---|--- Does the change alter how existing customer data is processed, stored, or accessed?| Yes. The change modifies how audit search results are reported during execution by providing incremental counts instead of a final total upfront. Does the change alter how admins can monitor, report on, or demonstrate compliance activities?| Yes. Administrators gain improved visibility into audit search progress through real-time result reporting, which can enhance monitoring workflows.

The Search-MailboxAuditLog and New-MailboxAuditLogSearch cmdlets will retire by December 2025. After March 1, 2025, mailbox audit logs become read-only. Organizations must transition to the Search-UnifiedAuditLog cmdlet for audit access, with migration support available from June 2025.

Introduction The `Search-UnifiedAuditLog` cmdlet is a critical PowerShell tool for monitoring security events in Microsoft 365, including role changes, permission updates, and incident response workflows. Recently, users have reported failures with the error: "Failed to process request via SyncSearch flag, returning HttpRequestException." This disruption could silently cripple automated security alerts, leaving organizations vulnerable to undetected threats. Learning Objectives Understand the impact of `Search-UnifiedAuditLog` failures on security monitoring.

After a year or so of using the AuditLog Query Graph API, we have enough experience to be able to explain how to take advantage of the API and when it could be used to run audit searches instead of the Search-UnifiedAuditLog cmdlet. There's lots of PowerShell code in this article to give anyone who wants to experiment with the API a good start to finding audit events.

Overview As part of our ongoing efforts to improve the logging capabilities of Exchange Online, we are sharing our timeline for decommissioning the...

The unified audit log is the source of a lot of information about a Microsoft 365 tenant. The Search-UnifiedAuditLog cmdlet is available to search the audit log and now we have the AuditLog Graph API....

Hi, I developed a powershell script to extract the licensing attribution and removal (Office 365). I'm using the cmdlet "Seach-UnifiedAuditLog" to extract all events with the operation "Change user license". I'm evaluating if the script is running fine, so I've told our Helpdesk to tell me when they attribute or remove a license, so I could run the script and check. Based on this I've found something odd, there are some cases where I can see on Azure AD Audit Log for that user that the license has been attributed, like this: But this specific user does not show up on the Audit Log. I've also tried to search the Audit Log manually, and the result is the same, this license attribution doesn't show up there. Anyone knows what am I missing here? Shouldn't both platforms give the same data? Thanks

Microsoft Purview and the Exchange Online Search-UnifiedAuditLog cmdlet both perform searches of the Microsoft 365 unified audit log. Both mechanisms support the concept of scoped searches to limit audit records returned by searches to the administrative units an account can manage. But the permissions assigned by the two mechanisms aren’t synchronized, which can lead to complications. <https://office365itpros.com/2024/08/27/scoped-audit-log-searches/>