Forum Discussion
Incomplete data from Search-UnifiedAuditLog cmdlet for AzureAD record type
Hi, From the below cmdlet I got AuditData parameter as an incomplete JSON string. Search-UnifiedAuditLog -Operations 'Update User.' -RecordType azureactivedirectory -StartDate (Get-Date).AddDays...
As I said, the truncation issue is being worked and we should have a solution soon. I am actively tracking the issue with engineering. See https://office365foritpros.com/2018/10/22/longer-retention-office365-auditdata/
Is that "soon" or "Microsoft soon™"? They sure are taking their sweet time with this...