Microsoft Purview | Audit: New HighCompleteness parameter in Search-UnifiedAuditLog Audit cmdlet

Microsoft is introducing a new feature for the Search-UnifiedAuditLog cmdlet in Microsoft Purview Audit, the HighCompleteness parameter which can retrieve more complete, exhaustive audit log records. Although it can slow down results, it prioritizes completeness over retrieval speed. The new feature is set to roll out in early May 2024, and Microsoft 365 Roadmap ID 388735 is associated with it.

Using the HighCompleteness parameter can provide a more comprehensive set of audit log records by prioritizing the completeness of search results over retrieval speed. On the other hand, disabling it could provide faster query results if completeness is less of a priority. There will be no immediate impact on the use of Search-UnifiedAuditLog, and the rollout will be automatic with no admin action required. In the meantime, you may want to notify your users about the change and update any relevant documentation as appropriate.

To use the HighCompleteness parameter, check out this sample request: Search-UnifiedAuditLog -StartDate 5/1/2023 -EndDate 5/2/2023 -HighCompleteness true. For more information, consult the Search-UnifiedAuditLog (ExchangePowerShell) on the Microsoft Learn platform. This update will be rolling out worldwide, GCC, GCC High, and DOD by late May 2024.

Message ID: MC775358

The post Microsoft Purview | Audit: New HighCompleteness parameter in Search-UnifiedAuditLog Audit cmdlet appeared first on M365 Admin.