MC736435Microsoft Purview Audit: HighCompleteness parameter in Search-UnifiedAuditLog Audit cmdlet

The Search-UnifiedAuditLog cmdlet is used to retrieve Audit logs from a specific date range or filtered results based on specified criteria. Very large queries aimed at retrieving a large number of audit records are susceptible to timeouts and may miss some results. With this new feature, we are introducing the HighCompleteness parameter to the cmdlet.

When enabled, the HighCompleteness switch is designed to provide a more exhaustive and comprehensive set of audit log records by prioritizing completeness of the search results over the speed of retrieval. 

Please note that using this parameter can result in slower performance in terms of how quickly the results are returned.

This message is associated with Microsoft 365 Roadmap ID 383741

When this will happen:

Public Preview: We will begin rolling out mid-March 2024 and expect to complete by late March 2024.

General Availability (Worldwide): We will begin rolling out early April 2024 and expect to complete by mid-April 2024. 

How this will affect your organization:

There will be no immediate impact to your existing usage of the Search-UnifiedAuditLog. If you want to use the new HighCompleteness parameter, please refer to the following sample request: Search-UnifiedAuditLog -StartDate 5/1/2023 -EndDate 5/2/2023 -HighCompleteness true

For more information, see Search-UnifiedAuditLog (ExchangePowerShell) | Microsoft Learn.

What you need to do to prepare:

This rollout will happen automatically by the specified date with no admin action required. You may want to notify your users about this change and update any relevant documentation as appropriate.