MC1505599Microsoft Purview Audit: AuditLogQuery API generally available and Search-UnifiedAuditLog retiring
Summary
The Microsoft Graph AuditLogQuery API will be generally available in October 2026, replacing the Search-UnifiedAuditLog PowerShell cmdlet, which will retire on October 15, 2027. Organizations using Search-UnifiedAuditLog must migrate to the API to avoid disruptions, as future audit search enhancements will focus on the API.
More information
What and why
The Microsoft Graph AuditLogQuery API is generally available for programmatic access to Microsoft Purview Audit activity logs. We are also announcing the planned retirement of the Search-UnifiedAuditLog PowerShell cmdlet on October 15, 2027.
The AuditLogQuery API provides improved scalability and reliability, more granular workload-level permissions, and support for exporting up to 1 million audit records per query. As audit data volumes and automation scenarios have grown, Search-UnifiedAuditLog has reached scalability limitations that can affect reliability and performance for large-volume searches. Future investments and enhancements for audit search will focus on the AuditLogQuery API.
Rollout schedule
Microsoft Graph AuditLogQuery API general availability (Worldwide): Beginning in early October 2026
Search-UnifiedAuditLog retirement:
- Search-UnifiedAuditLog will continue to function unchanged until October 15, 2027.
- On October 15, 2027, Search-UnifiedAuditLog will be retired and will no longer provide access to the audit log.
- Organizations using Search-UnifiedAuditLog should migrate to the Microsoft Graph AuditLogQuery API before October 15, 2027.
Impact on your organization
Who is affected
- Organizations that use Search-UnifiedAuditLog for audit data retrieval, reporting, investigations, compliance workflows, or automation are affected.
- Organizations that do not use Search-UnifiedAuditLog are not required to take action for this retirement.
Platforms and services
- Microsoft Purview Audit
- Microsoft Graph AuditLogQuery API
- Exchange PowerShell Search-UnifiedAuditLog cmdlet
What will happen
- Admins with the required permissions will be able to programmatically access audit logs through the Microsoft Graph AuditLogQuery API.
- Existing PowerShell scripts, applications, and automation workflows that call Search-UnifiedAuditLog will need to be updated to use the AuditLogQuery API.
- Search-UnifiedAuditLog will continue to function unchanged until October 15, 2027.
- On October 15, 2027, Search-UnifiedAuditLog will no longer provide access to the audit log.
- There is no tenant setting to prevent the retirement.
- Organizations that do not complete migration before October 15, 2027, may experience disruptions to audit retrieval processes that depend on Search-UnifiedAuditLog.
- Future investments and enhancements for audit search will focus on the AuditLogQuery API rather than Search-UnifiedAuditLog.
- The AuditLogQuery API supports exporting up to 1 million audit records per query.
- The AuditLogQuery API uses tenant-level throttling limits. Each tenant has a baseline of 200 search submissions per rolling 24-hour period and can have up to 50 searches queued or running at one time. Larger tenants may receive higher allocations based on eligible license counts.
- When a limit is reached, the API returns an HTTP 429 Too Many Requests response with retry guidance.
Action required and recommendations
- If your organization uses Search-UnifiedAuditLog, begin migration planning and complete the migration before October 15, 2027.
- Identify scripts, applications, automation workflows, and operational processes that currently use Search-UnifiedAuditLog.
- Evaluate the Microsoft Graph AuditLogQuery API and validate that it meets your audit retrieval requirements.
- Register your application with Microsoft Graph and add the required Microsoft Graph permissions.
- Update and test existing integrations to use the AuditLogQuery API.
- Complete migration before October 15, 2027, to avoid service disruption.
No action is required if your organization does not use Search-UnifiedAuditLog.
Learn more
- auditLogQuery resource type - Microsoft Graph v1.0 | Microsoft Learn
- Examples - List auditLogQueries - Microsoft Graph | Microsoft Learn
- Get started with auditing solutions | Microsoft Learn
- Learn about auditing solutions in Microsoft Purview | Microsoft Learn
- Microsoft Graph service-specific throttling limits - Microsoft Graph | Microsoft Learn
- Permissions - List auditLogQueries - Microsoft Graph | Microsoft Learn
- Search-UnifiedAuditLog (ExchangePowerShell) | Microsoft Learn
- Security audit log query service limits - Microsoft Graph service-specific throttling limits - Microsoft Graph | Microsoft Learn
- Use the Microsoft Graph API - Microsoft Graph | Microsoft Learn
Compliance considerations
| Question | Answer |
| Does the change modify, interrupt, or disable Audit logging capabilities? | Search-UnifiedAuditLog will no longer provide access to the Audit log effective October 15, 2027. |
| Does the change alter how admins can monitor, report on, or demonstrate compliance activities? | Programmatic retrieval of Microsoft Purview Audit activity logs is moving from Search-UnifiedAuditLog to the Microsoft Graph AuditLogQuery API for organizations using the retiring cmdlet. |
| Does the change include an admin control? | Access to the AuditLogQuery API requires applicable Microsoft Graph permissions. The retirement itself cannot be prevented through a tenant setting. The source does not state that the change can be controlled through Entra ID group membership. |