Forum Discussion
Incomplete data from Search-UnifiedAuditLog cmdlet for AzureAD record type
Hi, From the below cmdlet I got AuditData parameter as an incomplete JSON string. Search-UnifiedAuditLog -Operations 'Update User.' -RecordType azureactivedirectory -StartDate (Get-Date).AddDays...
Confirmed, I see the same. What's even worse, if you use the UI, you get a "Failure: Record truncated" error. I'm not sure how this made it to production, but it should be addressed ASAP. Open a support case.
As a workaround, you might be able to get the full event details from the Azure AD blade in the Azure portal.