MC1505599 Medium
Microsoft Purview Audit: AuditLogQuery API generally available and Search-UnifiedAuditLog retiring
Summary AI-generated
Microsoft Graph AuditLogQuery API is now generally available for accessing Purview Audit logs; Search-UnifiedAuditLog cmdlet will retire on October 15, 2027.
Suggested actions AI-generated
- Begin migration planning from Search-UnifiedAuditLog to AuditLogQuery API
- Identify scripts and workflows using Search-UnifiedAuditLog
- Evaluate and register apps for AuditLogQuery API permissions
- Update and test integrations with AuditLogQuery API
- Complete migration before October 15, 2027
Written by Azure OpenAI (gpt-4.1) from the text of the post below. It can be incomplete or wrong; the original post is authoritative.
Similar posts
Search for more like this- MC1469565 Microsoft Purview | Data Lifecycle Management - Graph API Support for archive mailboxes
- MC1220762 (Updated) Retirement notice: MDE and XDR Advanced Hunting APIs retiring; migrate to Microsoft Graph Security API
- MC1259827 Microsoft Purview: Data Security Investigations – analyze files tied to audit log activities
- MC1238428 (Updated) Microsoft Purview eDiscovery Configuration change for PowerShell cmdlet case
- MC1473155 (Updated) Microsoft Purview: permissions audit log improvements
- MC1481315 Microsoft Purview: Retirement of Data Security Posture Management (DSPM) classic and DSPM for AI classic experiences
Original post from Microsoft
[What and why]
The Microsoft Graph AuditLogQuery API is generally available for programmatic access to Microsoft Purview Audit activity logs. We are also announcing the planned retirement of the Search-UnifiedAuditLog PowerShell cmdlet on October 15, 2027.
The AuditLogQuery API provides improved scalability and reliability, more granular workload-level permissions, and support for exporting up to 1 million audit records per query. As audit data volumes and automation scenarios have grown, Search-UnifiedAuditLog has reached scalability limitations that can affect reliability and performance for large-volume searches. Future investments and enhancements for audit search will focus on the AuditLogQuery API.
[Rollout schedule]
Microsoft Graph AuditLogQuery API general availability (Worldwide): Beginning in early October 2026
Search-UnifiedAuditLog retirement:
- Search-UnifiedAuditLog will continue to function unchanged until October 15, 2027.
- On October 15, 2027, Search-UnifiedAuditLog will be retired and will no longer provide access to the audit log.
- Organizations using Search-UnifiedAuditLog should migrate to the Microsoft Graph AuditLogQuery API before October 15, 2027.
[Impact on your organization]
Who is affected
- Organizations that use Search-UnifiedAuditLog for audit data retrieval, reporting, investigations, compliance workflows, or automation are affected.
- Organizations that do not use Search-UnifiedAuditLog are not required to take action for this retirement.
Platforms and services
- Microsoft Purview Audit
- Microsoft Graph AuditLogQuery API
- Exchange PowerShell Search-UnifiedAuditLog cmdlet
What will happen
- Admins with the required permissions will be able to programmatically access audit logs through the Microsoft Graph AuditLogQuery API.
- Existing PowerShell scripts, applications, and automation workflows that call Search-UnifiedAuditLog will need to be updated to use the AuditLogQuery API.
- Search-UnifiedAuditLog will continue to function unchanged until October 15, 2027.
- On October 15, 2027, Search-UnifiedAuditLog will no longer provide access to the audit log.
- There is no tenant setting to prevent the retirement.
- Organizations that do not complete migration before October 15, 2027, may experience disruptions to audit retrieval processes that depend on Search-UnifiedAuditLog.
- Future investments and enhancements for audit search will focus on the AuditLogQuery API rather than Search-UnifiedAuditLog.
- The AuditLogQuery API supports exporting up to 1 million audit records per query.
- The AuditLogQuery API uses tenant-level throttling limits. Each tenant has a baseline of 200 search submissions per rolling 24-hour period and can have up to 50 searches queued or running at one time. Larger tenants may receive higher allocations based on eligible license counts.
- When a limit is reached, the API returns an HTTP 429 Too Many Requests response with retry guidance.
[Action required and recommendations]
- If your organization uses Search-UnifiedAuditLog, begin migration planning and complete the migration before October 15, 2027.
- Identify scripts, applications, automation workflows, and operational processes that currently use Search-UnifiedAuditLog.
- Evaluate the Microsoft Graph AuditLogQuery API and validate that it meets your audit retrieval requirements.
- Register your application with Microsoft Graph and add the required Microsoft Graph permissions.
- Update and test existing integrations to use the AuditLogQuery API.
- Complete migration before October 15, 2027, to avoid service disruption.
No action is required if your organization does not use Search-UnifiedAuditLog.
Learn more
- auditLogQuery resource type - Microsoft Graph v1.0 | Microsoft Learn
- Examples - List auditLogQueries - Microsoft Graph | Microsoft Learn
- Get started with auditing solutions | Microsoft Learn
- Learn about auditing solutions in Microsoft Purview | Microsoft Learn
- Microsoft Graph service-specific throttling limits - Microsoft Graph | Microsoft Learn
- Permissions - List auditLogQueries - Microsoft Graph | Microsoft Learn
- Search-UnifiedAuditLog (ExchangePowerShell) | Microsoft Learn
- Security audit log query service limits - Microsoft Graph service-specific throttling limits - Microsoft Graph | Microsoft Learn
- Use the Microsoft Graph API - Microsoft Graph | Microsoft Learn
[Compliance considerations]
| Question | Answer |
| Does the change modify, interrupt, or disable Audit logging capabilities? | Search-UnifiedAuditLog will no longer provide access to the Audit log effective October 15, 2027. |
| Does the change alter how admins can monitor, report on, or demonstrate compliance activities? | Programmatic retrieval of Microsoft Purview Audit activity logs is moving from Search-UnifiedAuditLog to the Microsoft Graph AuditLogQuery API for organizations using the retiring cmdlet. |
| Does the change include an admin control? | Access to the AuditLogQuery API requires applicable Microsoft Graph permissions. The retirement itself cannot be prevented through a tenant setting. The source does not state that the change can be controlled through Entra ID group membership. |
Additional details from Microsoft
- Summary
- The Microsoft Graph AuditLogQuery API will be generally available in October 2026, replacing the Search-UnifiedAuditLog PowerShell cmdlet, which will retire on October 15, 2027. Organizations using Search-UnifiedAuditLog must migrate to the API to avoid disruptions, as future audit search enhancements will focus on the API.