MWPRO IMPACT SCORE
OPERATIONAL IMPACT
62
0
25
50
75
100
HIGH IMPACT • REVIEW RECOMMENDED
Recommended Action:
Review the update and plan any required actions before rollout.
Review the update and plan any required actions before rollout.
What is MWPro Impact Score?
Watch our 60‑second explainer
Primary Audience
Tenant AdminsMicrosoft 365 AdminsCompliance TeamsSecurity TeamsIT ManagersService OwnersDevelopers
Why this score?
AI Confidence
HIGH
Enough detail is available to trust this assessment.
Assessment Reasoning
The Graph AuditLogQuery API becoming generally available and the planned retirement of Search-UnifiedAuditLog in 2027 require admins to migrate scripts, workflows, and automation that depend on the retiring cmdlet. The change mainly affects audit retrieval and compliance integrations, though end users are not directly impacted. Admins must map dependencies, reconfigure permissions, and test new API queries to maintain audit continuity. With more than a year before retirement, urgency is moderate but preparation should begin to avoid compliance reporting gaps.
80
Admin Impact
20
User Impact
60
Urgency
75
Effort
WHAT YOU NEED TO KNOW
AT A GLANCE
The new Microsoft Graph AuditLogQuery API is now generally available for accessing audit logs. The older Search-UnifiedAuditLog cmdlet will retire on 15 October 2027, so plan migration before then.
END USERS
No major end-user change expected.
IT ADMINS
Admins using Search-UnifiedAuditLog should plan and test migration to the AuditLogQuery API ahead of the 2027 retirement.
ROLLOUT TIMELINE
Available:
Now
Now
📢 Official Microsoft Message Center Announcement
Microsoft Purview Audit: AuditLogQuery API generally available and Search-UnifiedAuditLog retiring
Message ID: MC1505599
[What and why]
The Microsoft Graph AuditLogQuery API is generally available for programmatic access to Microsoft Purview Audit activity logs. We are also announcing the planned retirement of the Search-UnifiedAuditLog PowerShell cmdlet on October 15, 2027.
The AuditLogQuery API provides improved scalability and reliability, more granular workload-level permissions, and support for exporting up to 1 million audit records per query. As audit data volumes and automation scenarios have grown, Search-UnifiedAuditLog has reached scalability limitations that can affect reliability and performance for large-volume searches. Future investments and enhancements for audit search will focus on the AuditLogQuery API.
[Rollout schedule]
Microsoft Graph AuditLogQuery API general availability (Worldwide): Beginning in early October 2026
Search-UnifiedAuditLog retirement:
- Search-UnifiedAuditLog will continue to function unchanged until October 15, 2027.
- On October 15, 2027, Search-UnifiedAuditLog will be retired and will no longer provide access to the audit log.
- Organizations using Search-UnifiedAuditLog should migrate to the Microsoft Graph AuditLogQuery API before October 15, 2027.
[Impact on your organization]
Who is affected
- Organizations that use Search-UnifiedAuditLog for audit data retrieval, reporting, investigations, compliance workflows, or automation are affected.
- Organizations that do not use Search-UnifiedAuditLog are not required to take action for this retirement.
Platforms and services
- Microsoft Purview Audit
- Microsoft Graph AuditLogQuery API
- Exchange PowerShell Search-UnifiedAuditLog cmdlet
What will happen
- Admins with the required permissions will be able to programmatically access audit logs through the Microsoft Graph AuditLogQuery API.
- Existing PowerShell scripts, applications, and automation workflows that call Search-UnifiedAuditLog will need to be updated to use the AuditLogQuery API.
- Search-UnifiedAuditLog will continue to function unchanged until October 15, 2027.
- On October 15, 2027, Search-UnifiedAuditLog will no longer provide access to the audit log.
- There is no tenant setting to prevent the retirement.
- Organizations that do not complete migration before October 15, 2027, may experience disruptions to audit retrieval processes that depend on Search-UnifiedAuditLog.
- Future investments and enhancements for audit search will focus on the AuditLogQuery API rather than Search-UnifiedAuditLog.
- The AuditLogQuery API supports exporting up to 1 million audit records per query.
- The AuditLogQuery API uses tenant-level throttling limits. Each tenant has a baseline of 200 search submissions per rolling 24-hour period and can have up to 50 searches queued or running at one time. Larger tenants may receive higher allocations based on eligible license counts.
- When a limit is reached, the API returns an HTTP 429 Too Many Requests response with retry guidance.
[Action required and recommendations]
- If your organization uses Search-UnifiedAuditLog, begin migration planning and complete the migration before October 15, 2027.
- Identify scripts, applications, automation workflows, and operational processes that currently use Search-UnifiedAuditLog.
- Evaluate the Microsoft Graph AuditLogQuery API and validate that it meets your audit retrieval requirements.
- Register your application with Microsoft Graph and add the required Microsoft Graph permissions.
- Update and test existing integrations to use the AuditLogQuery API.
- Complete migration before October 15, 2027, to avoid service disruption.
No action is required if your organization does not use Search-UnifiedAuditLog.
Learn more
- auditLogQuery resource type – Microsoft Graph v1.0 | Microsoft Learn
- Examples – List auditLogQueries – Microsoft Graph | Microsoft Learn
- Get started with auditing solutions | Microsoft Learn
- Learn about auditing solutions in Microsoft Purview | Microsoft Learn
- Microsoft Graph service-specific throttling limits – Microsoft Graph | Microsoft Learn
- Permissions – List auditLogQueries – Microsoft Graph | Microsoft Learn
- Search-UnifiedAuditLog (ExchangePowerShell) | Microsoft Learn
- Security audit log query service limits – Microsoft Graph service-specific throttling limits – Microsoft Graph | Microsoft Learn
- Use the Microsoft Graph API – Microsoft Graph | Microsoft Learn
[Compliance considerations]
| Question | Answer |
| Does the change modify, interrupt, or disable Audit logging capabilities? | Search-UnifiedAuditLog will no longer provide access to the Audit log effective October 15, 2027. |
| Does the change alter how admins can monitor, report on, or demonstrate compliance activities? | Programmatic retrieval of Microsoft Purview Audit activity logs is moving from Search-UnifiedAuditLog to the Microsoft Graph AuditLogQuery API for organizations using the retiring cmdlet. |
| Does the change include an admin control? | Access to the AuditLogQuery API requires applicable Microsoft Graph permissions. The retirement itself cannot be prevented through a tenant setting. The source does not state that the change can be controlled through Entra ID group membership. |
Source: Microsoft Message Center • Analysed by MWPro
