Microsoft announced on October 12 that Search-UnifiedAuditLog, the Exchange Online PowerShell command many of us use to pull the Microsoft 365 audit log, will stop working on October 15, 2027. It works as normal until then and there's no tenant setting to put it off, but the notice tells admins to track down every script and workflow that calls it.
That's a bigger deal than it sounds, because this is the command the playbooks tell you to run. Microsoft's guide to investigating a compromised mailbox uses it, and so do Microsoft's own incident responders in their December 2023 write-up of a real OAuth attack. Mandiant's managed defense team recommended it in a 2020 post, and CISA's Untitled Goose Tool, last updated October 13, still pulls the audit log with it. Microsoft's last two retirement notices for older audit commands, in August 2024 and July 2025, both told admins to move to this one.
The replacement is the Graph AuditLogQuery API, and it isn't a drop-in swap. You register an app, an admin approves the permissions, and each search is created, checked until it finishes, and then read. The baseline is 200 searches per rolling 24 hours, with more for bigger tenants. On the plus side, it takes a list of users, so a loop that searches one user at a time can become a single search, and one query can return up to a million records instead of 50,000. But every script still has to be rewritten.
Microsoft says to use the Office 365 Management Activity API for recurring downloads, and nothing in the notice retires it. The catch is that Microsoft's FAQ says that API only returns the last 7 days, while the cmdlet returns the full retention period, so it can't answer what happened three months ago.
One more gap: Microsoft's Graph page lists the new API for the global service but not for US Government GCC High, DoD or China's 21Vianet cloud, and the notice only says "Worldwide."
What else in your environment calls this command, and if you're in a government cloud, has anyone heard what the plan is?defence
