Microsoft Purview Audit: AuditLogQuery API generally available and Search-UnifiedAuditLog retiring

🚨 The Signal: Microsoft Purview Audit is replacing the legacy PowerShell cmdlet Search-UnifiedAuditLog with the new AuditLogQuery API. This improves scalability and reliability for audit log retrieval, with the old cmdlet retiring by October 2027.

The Impact

Security and compliance teams using legacy audit log retrieval methods face a mandatory migration to a new API, risking audit data access if not actioned.

• Security teams: Risk of losing programmatic access to audit logs if migration is not completed.
• Compliance teams: Potential disruption to audit data collection for regulatory reporting.
• Automation developers: Required to rewrite scripts and integrations using the new API.
• Incident responders: May experience issues with automated audit log queries for investigations.

The Action

1. Identify all scripts and integrations currently using Search-UnifiedAuditLog.
2. Review Microsoft Graph AuditLogQuery API documentation for new capabilities and authentication methods.
3. Develop and test new audit log retrieval solutions using the AuditLogQuery API.
4. Plan and execute the migration of all affected systems to the new API before October 15, 2027.
5. Update internal documentation and playbooks to reflect the new audit log retrieval method.

Domain: Purview · Impact: high · Workload: Microsoft Purview