MC1310672 – M365 Change Digest

One-line summary

Search-UnifiedAuditLog's ResultCount now shows a live running total; new metadata indicates if more audit results are pending, impacting scripts relying on completed totals.

Similar updates

Details

Summary

Microsoft Purview updates the Search-UnifiedAuditLog cmdlet's ResultCount parameter to show a running count of results in real time, adding a new boolean property, AuditSearchRequestMetadata.moreRecordsAvailable, to indicate if more records remain. This improves query progress visibility and affects scripts relying on ResultCount as a final total.

Body (from Message Center)

[Introduction]

To improve performance and provide better visibility into query progress, we are updating the behavior of the ResultCount parameter for the Search-UnifiedAuditLog cmdlet in Microsoft Purview Audit.

Previously, the ResultCount parameter returned the total number of results expected from a query. With this update, ResultCount will display a running count of results as they are retrieved in real time.

We are also introducing a new boolean property, AuditSearchRequestMetadata.moreRecordsAvailable, which indicates whether additional records are still being retrieved.

Together, these updates provide administrators with improved transparency into audit log search progress and better support for script and automation scenarios.

[When this will happen]

General Availability (Worldwide, GCC): We began rolling out in mid-May 2026 and expect to complete by late May 2026.
General Availability (GCC High, DoD): We will begin rolling out in early June 2026 and expect to complete by late June 2026.

[How this affects your organization]

Who is affected

Administrators who use Microsoft Purview Audit
Administrators running the Search-UnifiedAuditLog cmdlet in PowerShell
Organizations with scripts or automation that rely on audit log search results

What will happen

The ResultCount parameter will now display a running count of results as they are retrieved during query execution.
A new boolean property, AuditSearchRequestMetadata.moreRecordsAvailable, will indicate whether additional records are still being retrieved.
While the query is running:
- ResultCount shows the number of records retrieved so far.
- moreRecordsAvailable is set to true.
When the query completes:
- ResultCount reflects the final total number of results.
- moreRecordsAvailable is set to false.
This feature is enabled by default.
There is no change to audit log data or retention.
Existing scripts that rely on ResultCount representing a final total before completion may require updates.

[What you can do to prepare]

Review existing scripts and automation that rely on ResultCount to determine total results.
Update scripts to use AuditSearchRequestMetadata.moreRecordsAvailable to confirm when queries are complete.
Adjust pagination or query logic to incorporate a check for AuditSearchRequestMetadata.moreRecordsAvailable to reliably determine whether more records remain.
Test audit log searches and automation during the rollout window from mid-May through late May 2026.
If you run Search-UnifiedAuditLog manually in PowerShell and review results interactively, no changes are needed. You will benefit from improved real-time progress visibility.

Learn more:

If you have questions or need assistance, contact Microsoft Support.

[Compliance considerations]

Question	Answer
Does the change alter how existing customer data is processed, stored, or accessed?	Yes. The change modifies how audit search results are reported during execution by providing incremental counts instead of a final total upfront.
Does the change alter how admins can monitor, report on, or demonstrate compliance activities?	Yes. Administrators gain improved visibility into audit search progress through real-time result reporting, which can enhance monitoring workflows.

Raw JSON (for debugging)

Expand/collapse the full payload below.

Show/hide raw

{
  "snapshot_item": {
    "action_required_by": null,
    "ai_action_required_by": "2026-05-31T00:00:00Z",
    "ai_actions": [
      "Review scripts using ResultCount",
      "Update automation to check moreRecordsAvailable",
      "Test audit log searches and automation"
    ],
    "ai_master_tags": [
      "Admin",
      "Security"
    ],
    "ai_model": "gpt-4.1",
    "ai_summary": "Search-UnifiedAuditLog\u0027s ResultCount now shows a live running total; new metadata indicates if more audit results are pending, impacting scripts relying on completed totals.",
    "ai_topics": [
      "Purview",
      "Exchange"
    ],
    "category": "planForChange",
    "details_map": {
      "Summary": "Microsoft Purview updates the Search-UnifiedAuditLog cmdlet\u0027s ResultCount parameter to show a running count of results in real time, adding a new boolean property, AuditSearchRequestMetadata.moreRecordsAvailable, to indicate if more records remain. This improves query progress visibility and affects scripts relying on ResultCount as a final total."
    },
    "id": "MC1310672",
    "importance": 4,
    "is_major_change": false,
    "last_modified": "2026-05-14T20:10:44Z",
    "ms_products": [
      "Purview"
    ],
    "platforms": null,
    "roadmap_ids": [],
    "services": [
      "Microsoft Purview"
    ],
    "severity": "normal",
    "tags": [
      "Feature update",
      "Admin impact"
    ],
    "title": "Microsoft Purview: Update to ResultCount parameter in the Search-UnifiedAuditLog cmdlet"
  }
}