Microsoft Purview: Update to ResultCount parameter in the Search-UnifiedAuditLog cmdlet

Microsoft Purview updates the Search-UnifiedAuditLog cmdlet’s ResultCount parameter to show a running count of results in real time, adding a new boolean property, AuditSearchRequestMetadata.moreRecordsAvailable, to indicate if more records remain. This improves query progress visibility and affects scripts relying on ResultCount as a final total. To improve performance and provide better visibility into query progress, we are updating the behavior of the ResultCount parameter for the Search-UnifiedAuditLog cmdlet in Microsoft Purview Audit. Previously, the ResultCount parameter returned the total number of results expected from a query. With this update, ResultCount will display a running count of results as they are retrieved in real time. We are also introducing a new boolean property, AuditSearchRequestMetadata.moreRecordsAvailable, which indicates whether additional records are still being retrieved. Together, these updates provide administrators with improved transparency into audit log search progress and better support for script and automation scenarios. When this will happen General Availability (Worldwide, GCC): We began rolling out in mid-May 2026 and expect to complete by late May 2026. General Availability (GCC High, DoD): We will begin rolling out in early June 2026 and expect to complete by late June 2026. How this affects your organization Who is affected Administrators who use Microsoft Purview Audit Administrators running the Search-UnifiedAuditLog cmdlet in PowerShell Organizations with scripts or automation that rely on audit log search results What will happen The ResultCount parameter will now display a running count of results as they are retrieved during query execution. A new boolean property, AuditSearchRequestMetadata.moreRecordsAvailable, will indicate whether additional records are still being retrieved. While the query is running: ResultCount shows the number of records retrieved so far. moreRecordsAvailable is set to true. When the query completes: ResultCount reflects the final total number of results. moreRecordsAvailable is set to false. This feature is enabled by default. There is no change to audit log data or retention. Existing scripts that rely on ResultCount representing a final total before completion may require updates. What you can do to prepare Review existing scripts and automation that rely on ResultCount to determine total results. Update scripts to use AuditSearchRequestMetadata.moreRecordsAvailable to confirm when […]

The post Microsoft Purview: Update to ResultCount parameter in the Search-UnifiedAuditLog cmdlet appeared first on M365 Admin.