MC1126353 – M365 Change Digest

One-line summary

Exchange Online will retire Search-MailboxAuditLog and New-MailboxAuditLogSearch cmdlets; audit logs become read-only March 1, 2025, and cmdlets fully retire end of December 2025. Use Search-UnifiedAuditLog going forward.

Similar updates

Details

Summary

The Search-MailboxAuditLog and New-MailboxAuditLogSearch cmdlets will retire by December 2025. After March 1, 2025, mailbox audit logs become read-only. Organizations must transition to the Search-UnifiedAuditLog cmdlet for audit access, with migration support available from June 2025.

Body (from Message Center)

Introduction

As part of our ongoing efforts to modernize and streamline audit logging in Exchange Online, we are retiring the Search-MailboxAuditLog and New-MailboxAuditLogSearch cmdlet. Organizations should transition to the Search-UnifiedAuditLogcmdlet for long-term audit log access and compliance.

When this will happen

March 1, 2025: New audit log data will no longer be written to individual mailboxes.
June 2025: Migration tools and documentation will be available to support transition.
End of December 2025: The Search-MailboxAuditLog and New-MailboxAuditLogSearch cmdlets will be fully retired.

How this affects your organization

After March 1, 2025, mailbox audit log data will become static and read-only. While existing data will remain accessible for historical review, no new data will be written to mailbox audit logs. By the end of 2025, the legacy cmdlets will no longer be available, and any scripts or tools relying on them will fail.

Organizations should ensure they are using the Search-UnifiedAuditLog cmdlet for audit log access going forward. This change supports improved scalability, centralized access, and long-term retention of audit data.

What you can do to prepare

To ensure a smooth transition:

Review your current usage of Search-MailboxAuditLog and New-MailboxAuditLogSearch to identify dependencies in scripts, tools, or workflows.
Engage with your legal and compliance teams to ensure regulatory requirements are met.
Confirm that auditing is enabled for your tenant.
Use the documentation (available June 2025) to transition to Search-UnifiedAuditLog.

Learn more: Microsoft Exchange Online: Search-MailboxAuditLog and New-MailboxAuditLogSearch will retire

Compliance considerations

Impacted Area	Explanation
Audit logging capabilities	Yes – This change retires legacy audit log cmdlets and shifts audit access to the unified audit log.
eDiscovery or Content Search	Yes – Organizations must use Search-UnifiedAuditLog for audit log searches going forward.
Retention policies, holds, or deletion workflows	Yes – Mailbox audit logs become static and read-only after March 2025.
Admin monitoring and reporting	Yes – Admins must update monitoring tools and reports to use the unified audit log.

Raw JSON (for debugging)

Expand/collapse the full payload below.

Show/hide raw

{
  "snapshot_item": {
    "action_required_by": "2025-12-30T08:00:00Z",
    "ai_action_required_by": null,
    "ai_actions": [
      "Review scripts and tools for cmdlet dependencies",
      "Engage legal/compliance teams",
      "Confirm auditing is enabled",
      "Plan migration to Search-UnifiedAuditLog"
    ],
    "ai_master_tags": [
      "Security"
    ],
    "ai_model": "gpt-4.1",
    "ai_summary": "Exchange Online will retire Search-MailboxAuditLog and New-MailboxAuditLogSearch cmdlets; audit logs become read-only March 1, 2025, and cmdlets fully retire end of December 2025. Use Search-UnifiedAuditLog going forward.",
    "ai_topics": [
      "Exchange"
    ],
    "category": "planForChange",
    "details_map": {
      "Summary": "The Search-MailboxAuditLog and New-MailboxAuditLogSearch cmdlets will retire by December 2025. After March 1, 2025, mailbox audit logs become read-only. Organizations must transition to the Search-UnifiedAuditLog cmdlet for audit access, with migration support available from June 2025."
    },
    "id": "MC1126353",
    "importance": 5,
    "is_major_change": false,
    "last_modified": "2025-07-31T23:20:03Z",
    "ms_products": [
      "Exchange"
    ],
    "platforms": null,
    "roadmap_ids": [],
    "services": [
      "Exchange Online"
    ],
    "severity": "normal",
    "tags": [
      "User impact",
      "Retirement"
    ],
    "title": "Retirement of Search-MailboxAuditLog and New-MailboxAuditLogSearch Cmdlets by End of 2025"
  }
}