MC789312 – M365 Change Digest

One-line summary

Microsoft Purview audit search UI update adding four new filter fields is postponed; no changes will proceed at this time.

Similar updates

Details

RoadmapIds

384092

Summary

Microsoft has decided not to proceed with the new audit search filters in Microsoft Purview at this time. The update included four new fields: Id, UserType, UserKey, and ClientIP. They will communicate further via the Message center when ready to proceed. No admin action is required.

Platforms

Web

Body (from Message Center)

Updated May 14, 2025: After further review we have decided not to proceed with this change at this time. We will communicate via Message center when we are ready to proceed. We apologize for any inconvenience.

In Microsoft Purview, audit search provides your organization with access to critical audit log event data, allowing you to gain insight and further investigate user activities. The Microsoft Purview Compliance portal’s audit search UI currently includes several search fields (i.e., date range, activities, workloads, users, etc.) to facilitate the retrieval of relevant logs. With a recent update, we have added four additional fields to the audit search UI.

These four fields are described below:

New filter field	Description
Id	Unique identifier of an audit record.
UserType	The type of user that performed the operation. See the UserType table for details on the types of users.
UserKey	Azure Active Directory Object ID in GUID format.
ClientIP	The IP address of the device that was used when the activity was logged.

This message is associated with Microsoft 365 Roadmap ID 384092.

[When this will happen:]

Public Preview: We will communicate via Message center when we are ready to proceed.

General Availability (Worldwide): We will communicate via Message center when we are ready to proceed.

[How this will affect your organization:]

Security admins in your organization who use audit in the Microsoft Purview compliance portal will be able to use these four additional fields to retrieve relevant audit logs.

[What you need to do to prepare:]

This rollout will happen automatically by the specified date with no admin action required before the rollout. You may want to notify your users about this change and update any relevant documentation as appropriate.

Additional resources

Search the audit log | Microsoft Learn

Raw JSON (for debugging)

Expand/collapse the full payload below.

Show/hide raw

{
  "snapshot_item": {
    "action_required_by": null,
    "ai_action_required_by": null,
    "ai_actions": [],
    "ai_master_tags": [
      "Security"
    ],
    "ai_model": "gpt-4.1",
    "ai_summary": "Microsoft Purview audit search UI update adding four new filter fields is postponed; no changes will proceed at this time.",
    "ai_topics": [
      "Microsoft 365",
      "Purview"
    ],
    "category": "stayInformed",
    "details_map": {
      "Platforms": "Web",
      "RoadmapIds": "384092",
      "Summary": "Microsoft has decided not to proceed with the new audit search filters in Microsoft Purview at this time. The update included four new fields: Id, UserType, UserKey, and ClientIP. They will communicate further via the Message center when ready to proceed. No admin action is required."
    },
    "id": "MC789312",
    "importance": 1,
    "is_major_change": false,
    "last_modified": "2025-05-14T19:19:36Z",
    "ms_products": [
      "Microsoft 365",
      "Purview"
    ],
    "platforms": "Web",
    "roadmap_ids": [
      "384092"
    ],
    "services": [
      "Microsoft 365 suite",
      "Microsoft Purview"
    ],
    "severity": "normal",
    "tags": [
      "Updated message",
      "New feature",
      "Admin impact"
    ],
    "title": "(Updated) Microsoft Purview | Audit search: New filters will be available"
  }
}