Microsoft is introducing the HighCompleteness parameter to the Search-UnifiedAuditLog cmdlet, which provides a more comprehensive set of audit log records by prioritizing completeness over speed. The parameter can result in slower performance, and it will be available for public preview in mid-March 2024 and for general availability in early April 2024. There will be no immediate impact on existing usage, and users can refer to a sample request to use the new parameter. No admin action is required for the rollout. For more information, refer to the provided link.
The Search-UnifiedAuditLog cmdlet is used to retrieve Audit logs from a specific date range or filtered results based on specified criteria. Very large queries aimed at retrieving a large number of audit records are susceptible to timeouts and may miss some results. With this new feature, we are introducing the HighCompleteness parameter to the cmdlet.
When enabled, the HighCompleteness switch is designed to provide a more exhaustive and comprehensive set of audit log records by prioritizing completeness of the search results over the speed of retrieval.
Please note that using this parameter can result in slower performance in terms of how quickly the results are returned.
This message is associated with Microsoft 365 Roadmap ID 383741
When this will happen:
Public Preview: We will begin rolling out mid-March 2024 and expect to complete by late March 2024.
General Availability (Worldwide): We will begin rolling out early April 2024 and expect to complete by mid-April 2024.
How this will affect your organization:
There will be no immediate impact to your existing usage of the Search-UnifiedAuditLog. If you want to use the new HighCompleteness parameter, please refer to the following sample request: Search-UnifiedAuditLog -StartDate 5/1/2023 -EndDate 5/2/2023 -HighCompleteness true
For more information, see Search-UnifiedAuditLog (ExchangePowerShell) | Microsoft Learn.
What you need to do to prepare:
This rollout will happen automatically by the specified date with no admin action required. You may want to notify your users about this change and update any relevant documentation as appropriate.