MicrosoftMicrosoft"As part of our ongoing efforts to improve the logging capabilities of Exchange Online"
You have not improved logging capabilities, instead you have introduced a regression. The audit records returned by the Search-UnifiedAuditlog is entirely incomplete. The inconsistency and incompleteness of the returned records is actually appalling.
"This change is a significant step towards enhancing our audit logging infrastructure and ensuring compliance with data retention standards. "
You have not enhanced an Exchange Administrators ability to answer auditing question, instead you have eliminated the ability for an exchange administrator to do so.
All of the most important events in exchange mailbox do not appear in the Search-UnifiedAuditLog even with the -HighCompleteness flag.
Which brings me to an important question: When would I not want “High Completeness” If I am performing a Audit to diagnose a reported issue I want ALL the data, every time.
I’m sorry but Unified Logging might be making someone happy, I just don’t know who that might be?
