Blog Post

Microsoft Security Community Blog
3 MIN READ

Microsoft Exchange Online: Search-MailboxAuditLog and New-MailboxAuditLogSearch will retire

ColbyBoone's avatar
ColbyBoone
Icon for Microsoft rankMicrosoft
Jan 14, 2025

As part of our ongoing efforts to improve the logging capabilities of Exchange Online, we are sharing our timeline for decommissioning the Search-MailboxAuditLog and New-MailboxAuditLogSearch cmdlets.

Important Update The licensing for the migration tool related to the deprecation of the Search-MailboxAuditLog cmdlet is specifically designed for customers with extended audit log retention set ...
Updated Mar 06, 2025
Version 3.0
audit
VasilMichev's avatar
VasilMichev
MVP
Jan 15, 2025

This was all fine back when the initial post was made, but since then you've also announced the upcoming change to force Search-UnifiedAuditLog to always use -HighCompleteness. This effectively leaves without any option to query the audit log synchronously and in turn will break huge percentage of existing automations. What is the proposed solution for such scenarios? 

  • ajanes-arc's avatar
    ajanes-arc
    Iron Contributor
    Jan 17, 2025

    I think this comment is critically under appreciated. I would also like to hear from Microsoft as to what the plan is here for allowing real time application integrations to this data. We have third party security platforms that are relying on this data to be synchronous.