Blog Post

Microsoft Security Community Blog
3 MIN READ

Microsoft Exchange Online: Search-MailboxAuditLog and New-MailboxAuditLogSearch will retire

ColbyBoone's avatar
ColbyBoone
Icon for Microsoft rankMicrosoft
Jan 14, 2025

As part of our ongoing efforts to improve the logging capabilities of Exchange Online, we are sharing our timeline for decommissioning the Search-MailboxAuditLog and New-MailboxAuditLogSearch cmdlets.

[UPDATE February 18, 2026] :  We would like to inform you that the Search-MailboxAuditLog and New-MailboxAuditLogSearch cmdlets have been fully retired and removed from Exchange Online. All audit log...
Updated Feb 18, 2026
Version 5.0
audit
melaniekremer212's avatar
melaniekremer212
Copper Contributor
Jan 27, 2025

How will this impact advanced auditing on shared mailboxes?  I regularly have to search shared mailboxes for "who deleted this email" and that is not available in the unified log. 

  • RaksChauhan's avatar
    RaksChauhan
    Iron Contributor
    Jan 27, 2025

    melaniekremer212- i asked this question last year when they first proposed the changes as we use this extensively too. MS advised this is the new method, which i find makes things super complicated. Link here for Shared Mailboxes: 

    https://learn.microsoft.com/en-us/purview/audit-troubleshooting-scenarios#search-for-mailbox-activities-performed-in-a-specific-mailbox-including-shared-mailboxes

    • ColbyBoone's avatar
      ColbyBoone
      Icon for Microsoft rankMicrosoft
      Jan 31, 2025

      Hi RaksChauhan, 

      Thank you for your comment. We can confirm that the documentation you provided is correct. We understand that the changes might seem challenging. 

      Could you please share any specific feedback on how we can improve the documentation? Your insights would be very helpful.