MicrosoftMicrosoftThere's a lot to not be OK about with this change. The Search-UnifiedAuditLog gives less than complete results by design. It has the "-HighCompleteness" parameter whose name just gives this away, to start. Next, there's a -ResultSize parameter that is limited to 5000, unlike most / maybe all other Exchange cmdlets that take numbers or "Unlimited". But then we have this new parameter / value that we need to know and supply "-SessionCommand ReturnLargeSet".
It's fine that these oddities are there since this command is meant not only for Exchange auditing, but auditing for other M365 services, but it's a huge downgrade from Search-MailboxAuditLog which is infinitely more logical, intuitive, and fitting for searching Exchange mailbox audit logs!
Add in the fact that you're giving customers some kind of "migration tool" to handle trying to make the new thing closer to as good as the old thing, while the old thing is sadly on its way out the door, is just terrible.
Migration Tool
If you suspect that some legacy Exchange mailbox audit logs are not present in the Unified Audit Log you can use this upcoming migration tool to move that data into the UAL. This optional self-service migration tool can be run by tenant administrators. To assist, we will provide documentation that includes a guide for use prior to the March 1ST deadline. Our documentation will include common issues and their resolutions.
By following these steps, you will be able to achieve a smooth and efficient migration while maintaining compliance and data integrity.
So, even today (Trump's day), there are mailbox audit logs that can only be found via Search-MailboxAuditLog, and it's somehow on me to migrate the logs to the new tool? Completely unacceptable. Deadline you say? What deadline. Are you just going to leave it so customers have to fend for themselves to get this done? You should have been migrating this stuff all along since Search-UnifiedAuditLog has been there all along and is supposed to have been working all along. Meanwhile, it never has worked even close to as good as Search-MailboxAuditLog and the fact that we have to fix this ourselves to keep up with your unwelcomed change is ludicrous.
This is a poorly executed and unnecessary, forced change that nobody is asking for.
MicrosoftHi Jeremy ,
Thank you for your question! We want to clarify that migration of logs applies for those who have set long retention ( older than a year ) on audit needs in Exchange , and would like to backfill that historical data to Purview. This ensures that all relevant data is captured and stored appropriately. Please let us know if you have any further questions or need additional information.
Unacceptable if you are paying for the E5 add-on in Pureview
Totally unacceptable if you are paying for the E5 add-on!
