The cmdlets `Search-MailboxAuditLog` and `New-MailboxAuditLogSearch` in Microsoft Exchange Online will retire in March 2025. Admins can access and modify records until late June 2025, after which they become static. Users should be notified, documentation updated, and auditing enabled to use `Search-UnifiedAuditLog`.
We will retire the Search-MailboxAuditLog and New-MailboxAuditLogSearch cmdlets in Microsoft Exchange Online starting March 1, 2025, and completing in late March 2025. After the retirement, new records will be written to Search-UnifiedAuditLog and Search-MailboxAuditLog will be accessible only as a historical record.
How this will affect your organization:
After the retirement, admins will be able to access Search-MailboxAuditLog and New-MailboxAuditlogSearch and make changes and downloads until late June 2025. After late June, Search-MailboxAuditLog and New-MailboxAuditlogSearch will become a static record only, and admins will no longer be able to make changes and downloads.
What you need to do to prepare:
This change will happen automatically by the specified dates. Please notify your users about this change, update your relevant documentation, and share the alternate capability Search-UnifiedAuditLog.
To use the Search-UnifiedAuditLog cmdlet, you must ensure auditing is enabled for your tenant.
Learn more about enabling auditing for your tenant and about the changes to these cmdlets: Microsoft Exchange Online: Search-MailboxAuditLog and New-MailboxAuditLogSearch will retire | Microsoft Community Hub