Services
Summary
Microsoft Purview updates the Search-UnifiedAuditLog cmdlet's ResultCount parameter to show a running count of results in real time, adding a new boolean property, AuditSearchRequestMetadata.moreRecordsAvailable, to indicate if more records remain. This improves query progress visibility and affects scripts relying on ResultCount as a final total.
Details
Introduction
To improve performance and provide better visibility into query progress, we are updating the behavior of the ResultCount parameter for the Search-UnifiedAuditLog cmdlet in Microsoft Purview Audit.
Previously, the ResultCount parameter returned the total number of results expected from a query. With this update, ResultCount will display a running count of results as they are retrieved in real time.
We are also introducing a new boolean property, AuditSearchRequestMetadata.moreRecordsAvailable, which indicates whether additional records are still being retrieved.
Together, these updates provide administrators with improved transparency into audit log search progress and better support for script and automation scenarios.
When this will happen
- General Availability (Worldwide, GCC): We began rolling out in mid-May 2026 and expect to complete by late May 2026.
- General Availability (GCC High, DoD): We will begin rolling out in early June 2026 and expect to complete by late June 2026.
How this affects your organization
Who is affected
- Administrators who use Microsoft Purview Audit
- Administrators running the Search-UnifiedAuditLog cmdlet in PowerShell
- Organizations with scripts or automation that rely on audit log search results
What will happen
- The ResultCount parameter will now display a running count of results as they are retrieved during query execution.
- A new boolean property, AuditSearchRequestMetadata.moreRecordsAvailable, will indicate whether additional records are still being retrieved.
- While the query is running:
- ResultCount shows the number of records retrieved so far.
- moreRecordsAvailable is set to true.
- When the query completes:
- ResultCount reflects the final total number of results.
- moreRecordsAvailable is set to false.
- This feature is enabled by default.
- There is no change to audit log data or retention.
- Existing scripts that rely on ResultCount representing a final total before completion may require updates.
What you can do to prepare
- Review existing scripts and automation that rely on ResultCount to determine total results.
- Update scripts to use AuditSearchRequestMetadata.moreRecordsAvailable to confirm when queries are complete.
- Adjust pagination or query logic to incorporate a check for AuditSearchRequestMetadata.moreRecordsAvailable to reliably determine whether more records remain.
- Test audit log searches and automation during the rollout window from mid-May through late May 2026.
- If you run Search-UnifiedAuditLog manually in PowerShell and review results interactively, no changes are needed. You will benefit from improved real-time progress visibility.
Learn more:
- Learn about auditing solutions in Microsoft Purview | Microsoft Purview | Microsoft Learn
- Search-UnifiedAuditLog | policy-and-compliance-audit | ExchangePowerShell | Microsoft Learn
If you have questions or need assistance, contact Microsoft Support.
Compliance considerations
| Question | Answer |
| Does the change alter how existing customer data is processed, stored, or accessed? | Yes. The change modifies how audit search results are reported during execution by providing incremental counts instead of a final total upfront. |
| Does the change alter how admins can monitor, report on, or demonstrate compliance activities? | Yes. Administrators gain improved visibility into audit search progress through real-time result reporting, which can enhance monitoring workflows. |