MC775358Microsoft Purview | Audit: New HighCompleteness parameter in Search-UnifiedAuditLog Audit cmdlet

In Microsoft Purview Audit, the Search-UnifiedAuditLog cmdlet in Microsoft Exchange Online PowerShell is used to retrieve Audit logs from a specific date range or filtered results based on specified criteria. Very large queries aimed at retrieving a large number of audit records are susceptible to timeouts and may miss some results. With this new feature, we are introducing the HighCompleteness parameter to the cmdlet.

Please note that using this parameter can result in results being returned more slowly.

This message is associated with Microsoft 365 Roadmap ID 388735.

When this will happen:

General Availability (Worldwide, GCC, GCC High, DOD): We will begin rolling out early May 2024 and expect to complete by late May 2024.

How this will affect your organization:

When enabled, the HighCompleteness parameter will provide a more exhaustive and comprehensive set of audit log records by prioritizing completeness of search results over speed of retrieval. When disabled, the query runs faster but may have missing search results.

There will be no immediate impact to your existing use of Search-UnifiedAuditLog. To use the new HighCompleteness parameter, please refer to this sample request:

Search-UnifiedAuditLog -StartDate 5/1/2023 -EndDate 5/2/2023 -HighCompleteness true

Learn more: Search-UnifiedAuditLog (ExchangePowerShell) | Microsoft Learn

What you need to do to prepare:

This rollout will happen automatically by the specified date with no admin action required. You may want to notify your users about this change and update any relevant documentation as appropriate.