Microsoft Purview Audit: AuditLogQuery API generally available and Search-UnifiedAuditLog retiring

[What and why]

The Microsoft Graph AuditLogQuery API is generally available for programmatic access to Microsoft Purview Audit activity logs. We are also announcing the planned retirement of the Search-UnifiedAuditLog PowerShell cmdlet on October 15, 2027.

The AuditLogQuery API provides improved scalability and reliability, more granular workload-level permissions, and support for exporting up to 1 million audit records per query. As audit data volumes and automation scenarios have grown, Search-UnifiedAuditLog has reached scalability limitations that can affect reliability and performance for large-volume searches. Future investments and enhancements for audit search will focus on the AuditLogQuery API.

[Rollout schedule] 

Microsoft Graph AuditLogQuery API general availability (Worldwide): Beginning in early October 2026

Search-UnifiedAuditLog retirement:

• Search-UnifiedAuditLog will continue to function unchanged until October 15, 2027.
• On October 15, 2027, Search-UnifiedAuditLog will be retired and will no longer provide access to the audit log.
• Organizations using Search-UnifiedAuditLog should migrate to the Microsoft Graph AuditLogQuery API before October 15, 2027.

[Impact on your organization]

Who is affected

• Organizations that use Search-UnifiedAuditLog for audit data retrieval, reporting, investigations, compliance workflows, or automation are affected.
• Organizations that do not use Search-UnifiedAuditLog are not required to take action for this retirement.

Platforms and services

• Microsoft Purview Audit
• Microsoft Graph AuditLogQuery API
• Exchange PowerShell Search-UnifiedAuditLog cmdlet

What will happen

• Admins with the required permissions will be able to programmatically access audit logs through the Microsoft Graph AuditLogQuery API.
• Existing PowerShell scripts, applications, and automation workflows that call Search-UnifiedAuditLog will need to be updated to use the AuditLogQuery API.
• Search-UnifiedAuditLog will continue to function unchanged until October 15, 2027.
• On October 15, 2027, Search-UnifiedAuditLog will no longer provide access to the audit log.
• There is no tenant setting to prevent the retirement.
• Organizations that do not complete migration before October 15, 2027, may experience disruptions to audit retrieval processes that depend on Search-UnifiedAuditLog.
• Future investments and enhancements for audit search will focus on the AuditLogQuery API rather than Search-UnifiedAuditLog.
• The AuditLogQuery API supports exporting up to 1 million audit records per query.
• The AuditLogQuery API uses tenant-level throttling limits. Each tenant has a baseline of 200 search submissions per rolling 24-hour period and can have up to 50 searches queued or running at one time. Larger tenants may receive higher allocations based on eligible license counts.
• When a limit is reached, the API returns an HTTP 429 Too Many Requests response with retry guidance.

[Action required and recommendations]

• If your organization uses Search-UnifiedAuditLog, begin migration planning and complete the migration before October 15, 2027.
• Identify scripts, applications, automation workflows, and operational processes that currently use Search-UnifiedAuditLog.
• Evaluate the Microsoft Graph AuditLogQuery API and validate that it meets your audit retrieval requirements.
• Register your application with Microsoft Graph and add the required Microsoft Graph permissions.
• Update and test existing integrations to use the AuditLogQuery API.
• Complete migration before October 15, 2027, to avoid service disruption.

No action is required if your organization does not use Search-UnifiedAuditLog.

Learn more

• auditLogQuery resource type - Microsoft Graph v1.0 | Microsoft Learn
• Examples - List auditLogQueries - Microsoft Graph | Microsoft Learn
• Get started with auditing solutions | Microsoft Learn
• Learn about auditing solutions in Microsoft Purview | Microsoft Learn
• Microsoft Graph service-specific throttling limits - Microsoft Graph | Microsoft Learn
• Permissions - List auditLogQueries - Microsoft Graph | Microsoft Learn
• Search-UnifiedAuditLog (ExchangePowerShell) | Microsoft Learn
• Security audit log query service limits - Microsoft Graph service-specific throttling limits - Microsoft Graph | Microsoft Learn
• Use the Microsoft Graph API - Microsoft Graph | Microsoft Learn

[Compliance considerations]