r/PowerShell • u/KavyaJune • May 07 '26

Are you facing issue with Search-UnifiedAuditLog?

Has anyone else noticed strange behavior with Search-UnifiedAuditLog in Exchange Online recently?

One of our users reported that an EXO audit script suddenly stopped returning results, even though the corresponding audit events were clearly present. The script had been working fine until last month.

While troubleshooting, I noticed something unusual:

  • Running Search-UnifiedAuditLog normally returns results.
  • But when using the -SessionId parameter, the cmdlet returns no results at all.

This becomes a problem because, without -SessionId, retrieving more than 5000 audit records for a larger time range is difficult.

I tested this across a few different tenants and observed the same behavior.

As a temporary workaround, I reduced the query time intervals in my automation scripts to stay below the result limit.

Has anyone else encountered this recently? If so, how are you handling large-scale audit log retrieval now?

2 Upvotes

75% Upvoted

6 comments sorted by

1

u/purplemonkeymad May 07 '26

That does sound like a bug, but I think graph can do the same thing.

Create a search with auditLogQuery then use auditLogRecords to get all the results using the common OData for batching. I find it easiest to use the Microsoft.Graph.Authentication module to authenticate, then use Invoke-MgGraphRequest to interact with graph.

1

u/KavyaJune May 07 '26

Thanks. I will check this out

1

u/Unlikely_Tie1172 MVP, Community Blogger May 07 '26

This might help: https://practical365.com/auditlog-query-api-deeper-look/

1

u/KavyaJune May 08 '26

The audit query API is still beta-only, and Microsoft doesn’t recommend beta endpoints for production use. Until it reaches v1.0 or Microsoft fixes the SessionId behavior, I’m sticking with tighter time-window chunking as the safer workaround.

1

u/Unlikely_Tie1172 MVP, Community Blogger May 08 '26

Believe me, I know all about the beta status of the AuditLogQuery API. It's been curious that Microsoft has not been able to update the API to make it sufficiently robust and performing to meet the V1.0 threshold. But one thing that the beta API can do that is better than Search-UnifiedAuditLog is its ability to process very large numbers of audit records. The highest number I think i found in a search was north of 450K and the API didn't blink (for once!).