MC1505599 - Microsoft Purview Audit: AuditLogQuery API generally available and Search-UnifiedAuditLog retiring

Message Center

Summary

The Microsoft Graph AuditLogQuery API will be generally available in October 2026, replacing the Search-UnifiedAuditLog PowerShell cmdlet, which will retire on October 15, 2027. Organizations using Search-UnifiedAuditLog must migrate to the API to avoid disruptions, as future audit search enhancements will focus on the API.

Discussionpowered by zap.ms

Message ID

MC1505599

View in Message Center

Published

Oct 12, 2026

Service

Microsoft Purview

Tag

New feature

User impact

Admin impact

Retirement

More information

What and why

The Microsoft Graph AuditLogQuery API is generally available for programmatic access to Microsoft Purview Audit activity logs. We are also announcing the planned retirement of the Search-UnifiedAuditLog PowerShell cmdlet on October 15, 2027.

The AuditLogQuery API provides improved scalability and reliability, more granular workload-level permissions, and support for exporting up to 1 million audit records per query. As audit data volumes and automation scenarios have grown, Search-UnifiedAuditLog has reached scalability limitations that can affect reliability and performance for large-volume searches. Future investments and enhancements for audit search will focus on the AuditLogQuery API.

Rollout schedule

Microsoft Graph AuditLogQuery API general availability (Worldwide): Beginning in early October 2026

Search-UnifiedAuditLog retirement:

Search-UnifiedAuditLog will continue to function unchanged until October 15, 2027.
On October 15, 2027, Search-UnifiedAuditLog will be retired and will no longer provide access to the audit log.
Organizations using Search-UnifiedAuditLog should migrate to the Microsoft Graph AuditLogQuery API before October 15, 2027.

Impact on your organization

Who is affected

Organizations that use Search-UnifiedAuditLog for audit data retrieval, reporting, investigations, compliance workflows, or automation are affected.
Organizations that do not use Search-UnifiedAuditLog are not required to take action for this retirement.

Platforms and services

Microsoft Purview Audit
Microsoft Graph AuditLogQuery API
Exchange PowerShell Search-UnifiedAuditLog cmdlet

What will happen

Admins with the required permissions will be able to programmatically access audit logs through the Microsoft Graph AuditLogQuery API.
Existing PowerShell scripts, applications, and automation workflows that call Search-UnifiedAuditLog will need to be updated to use the AuditLogQuery API.
Search-UnifiedAuditLog will continue to function unchanged until October 15, 2027.
On October 15, 2027, Search-UnifiedAuditLog will no longer provide access to the audit log.
There is no tenant setting to prevent the retirement.
Organizations that do not complete migration before October 15, 2027, may experience disruptions to audit retrieval processes that depend on Search-UnifiedAuditLog.
Future investments and enhancements for audit search will focus on the AuditLogQuery API rather than Search-UnifiedAuditLog.
The AuditLogQuery API supports exporting up to 1 million audit records per query.
The AuditLogQuery API uses tenant-level throttling limits. Each tenant has a baseline of 200 search submissions per rolling 24-hour period and can have up to 50 searches queued or running at one time. Larger tenants may receive higher allocations based on eligible license counts.
When a limit is reached, the API returns an HTTP 429 Too Many Requests response with retry guidance.

Action required and recommendations

If your organization uses Search-UnifiedAuditLog, begin migration planning and complete the migration before October 15, 2027.
Identify scripts, applications, automation workflows, and operational processes that currently use Search-UnifiedAuditLog.
Evaluate the Microsoft Graph AuditLogQuery API and validate that it meets your audit retrieval requirements.
Register your application with Microsoft Graph and add the required Microsoft Graph permissions.
Update and test existing integrations to use the AuditLogQuery API.
Complete migration before October 15, 2027, to avoid service disruption.

No action is required if your organization does not use Search-UnifiedAuditLog.

Learn more

Compliance considerations

Question	Answer
Does the change modify, interrupt, or disable Audit logging capabilities?	Search-UnifiedAuditLog will no longer provide access to the Audit log effective October 15, 2027.
Does the change alter how admins can monitor, report on, or demonstrate compliance activities?	Programmatic retrieval of Microsoft Purview Audit activity logs is moving from Search-UnifiedAuditLog to the Microsoft Graph AuditLogQuery API for organizations using the retiring cmdlet.
Does the change include an admin control?	Access to the AuditLogQuery API requires applicable Microsoft Graph permissions. The retirement itself cannot be prevented through a tenant setting. The source does not state that the change can be controlled through Entra ID group membership.

Discussion

All Message Center discussions