MC1505599 - Microsoft Purview Audit: AuditLogQuery API generally available and Search-UnifiedAuditLog retiring

Microsoft 365 Message Center announcement MC1505599.

Message Center ID

MC1505599

Category

plan For Change

Severity

normal

Services

Microsoft Purview

Tags

New feature, User impact, Admin impact, Retirement

Published

2026-10-12

Last updated

2026-10-12

Expires

2027-01-25

[What and why] The Microsoft Graph AuditLogQuery API is generally available for programmatic access to Microsoft Purview Audit activity logs. We are also announcing the planned retirement of the Search-UnifiedAuditLog PowerShell cmdlet on October 15, 2027. The AuditLogQuery API provides improved scalability and reliability, more granular workload-level permissions, and support for exporting up to 1 million audit records per query. As audit data volumes and automation scenarios have grown, Search-UnifiedAuditLog has reached scalability limitations that can affect reliability and performance for large-volume searches. Future investments and enhancements for audit search will focus on the AuditLogQuery API. [Rollout schedule] Microsoft Graph AuditLogQuery API general availability (Worldwide): Beginning in early October 2026 Search-UnifiedAuditLog retirement: Search-UnifiedAuditLog will continue to function unchanged until October 15, 2027. On October 15, 2027, Search-UnifiedAuditLog will be retired and will no longer provide access to the audit log. Organizations using Search-UnifiedAuditLog should migrate to the Microsoft Graph AuditLogQuery API before October 15, 2027. [Impact on your organization] Who is affected Organizations that use Search-UnifiedAuditLog for audit data retrieval, reporting, investigations, compliance workflows, or automation are affected. Organizations that do not use Search-UnifiedAuditLog are not required to take action for this retirement. Platforms and services Microsoft Purview Audit Microsoft Graph AuditLogQuery API Exchange PowerShell Search-UnifiedAuditLog cmdlet What will happen Admins with the required permissions will be able to programmatically access audit logs through the Microsoft Graph AuditLogQuery API. Existing PowerShell scripts, applications, and automation workflows that call Search-UnifiedAuditLog will need to be updated to use the AuditLogQuery API. Search-UnifiedAuditLog will continue to function unchanged until October 15, 2027. On October 15, 2027, Search-UnifiedAuditLog will no longer provide access to the audit log. There is no tenant setting to prevent the retirement. Organizations that do not complete migration before October 15, 2027, may experience disruptions to audit retrieval processes that depend on Search-UnifiedAuditLog. Future investments and enhancements for audit search will focus on the AuditLogQuery API rather than Search-UnifiedAuditLog. The AuditLogQuery API supports exporting up to 1 million audit records per query. The AuditLogQuery API uses tenant-level throttling limits. Each tenant has a baseline of 200 search submissions per rolling 24-hour period and can have up to 50 searches queued or running at one time. Larger tenants may receive higher allocations based on eligible license counts. When a limit is reached, the API returns an HTTP 429 Too Many Requests response with retry guidance. [Action required and recommendations] If your organization uses Search-UnifiedAuditLog, begin migration planning and complete the migration before October 15, 2027. Identify scripts, applications, automation workflows, and operational processes that currently use Search-UnifiedAuditLog. Evaluate the Microsoft Graph AuditLogQuery API and validate that it meets your audit retrieval requirements. Register your application with Microsoft Graph and add the required Microsoft Graph permissions. Update and test existing integrations to use the AuditLogQuery API. Complete migration before October 15, 2027, to avoid service disruption. No action is required if your organization does not use Search-UnifiedAuditLog. Learn more auditLogQuery resource type - Microsoft Graph v1.0 | Microsoft Learn Examples - List auditLogQueries - Microsoft Graph | Microsoft Learn Get started with auditing solutions | Microsoft Learn Learn about auditing solutions in Microsoft Purview | Microsoft Learn Microsoft Graph service-specific throttling limits - Microsoft Graph | Microsoft Learn Permissions - List auditLogQueries - Microsoft Graph | Microsoft Learn Search-UnifiedAuditLog (ExchangePowerShell) | Microsoft Learn Security audit log query service limits - Microsoft Graph service-specific throttling limits - Microsoft Graph | Microsoft Learn Use the Microsoft Graph API - Microsoft Graph | Microsoft Learn [Compliance considerations] Question Answer Does the change modify, interrupt, or disable Audit logging capabilities? Search-UnifiedAuditLog will no longer provide access to the Audit log effective October 15, 2027. Does the change alter how admins can monitor, report on, or demonstrate compliance activities? Programmatic retrieval of Microsoft Purview Audit activity logs is moving from Search-UnifiedAuditLog to the Microsoft Graph AuditLogQuery API for organizations using the retiring cmdlet. Does the change include an admin control? Access to the AuditLogQuery API requires applicable Microsoft Graph permissions. The retirement itself cannot be prevented through a tenant setting. The source does not state that the change can be controlled through Entra ID group membership.