Microsoft Purview Audit: AuditLogQuery API generally available and Search-UnifiedAuditLog retiring

The Microsoft Graph AuditLogQuery API will be generally available in October 2026, replacing the Search-UnifiedAuditLog PowerShell cmdlet, which will retire on October 15, 2027. Organizations using Search-UnifiedAuditLog must migrate to the API to avoid disruptions, as future audit search enhancements will focus on the API. The Microsoft Graph AuditLogQuery API is generally available for programmatic access to Microsoft Purview Audit activity logs. We are also announcing the planned retirement of the Search-UnifiedAuditLog PowerShell cmdlet on October 15, 2027. The AuditLogQuery API provides improved scalability and reliability, more granular workload-level permissions, and support for exporting up to 1 million audit records per query. As audit data volumes and automation scenarios have grown, Search-UnifiedAuditLog has reached scalability limitations that can affect reliability and performance for large-volume searches. Future investments and enhancements for audit search will focus on the AuditLogQuery API. Rollout schedule  Microsoft Graph AuditLogQuery API general availability (Worldwide): Beginning in early October 2026 Search-UnifiedAuditLog retirement: Search-UnifiedAuditLog will continue to function unchanged until October 15, 2027. On October 15, 2027, Search-UnifiedAuditLog will be retired and will no longer provide access to the audit log. Organizations using Search-UnifiedAuditLog should migrate to the Microsoft Graph AuditLogQuery API before October 15, 2027. Impact on your organization Who is affected Organizations that use Search-UnifiedAuditLog for audit data retrieval, reporting, investigations, compliance workflows, or automation are affected. Organizations that do not use Search-UnifiedAuditLog are not required to take action for this retirement. Platforms and services Microsoft Purview Audit Microsoft Graph AuditLogQuery API Exchange PowerShell Search-UnifiedAuditLog cmdlet What will happen Admins with the required permissions will be able to programmatically access audit logs through the Microsoft Graph AuditLogQuery API. Existing PowerShell scripts, applications, and automation workflows that call Search-UnifiedAuditLog will need to be updated to use the AuditLogQuery API. Search-UnifiedAuditLog will continue to function unchanged until October 15, 2027. On October 15, 2027, Search-UnifiedAuditLog will no longer provide access to the audit log. There is no tenant setting to prevent the retirement. Organizations that do not complete migration before October 15, 2027, may experience disruptions to audit retrieval processes that depend on Search-UnifiedAuditLog. Future investments and enhancements for […]

The post Microsoft Purview Audit: AuditLogQuery API generally available and Search-UnifiedAuditLog retiring appeared first on M365 Admin.