Commands › Exchange Online

Get-AuditLogSearch

Exchange Online ExchangeOnlineManagement Get-*

Return a list of current audit log searches that were created with the New-AdminAuditLogSearch or New-MailboxAuditLogSearch cmdlets. The Get-AuditLogSearch cmdlet also returns audit log searches that are initiated whenever an administrator uses the Exchange admin center (EAC) to export audit logs.

Quick start script

# Get-AuditLogSearch — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Run and inspect
Get-AuditLogSearch | Format-List

# 3. Export for evidence / drift tracking
Get-AuditLogSearch | Export-Clixml .\AuditLogSearch-$(Get-Date -Format yyyyMMdd).xml

Syntax

Get-AuditLogSearch [[-Identity] <AuditLogSearchIdParameter>]
 [-CreatedAfter <ExDateTime>]
 [-CreatedBefore <ExDateTime>]
 [-ResultSize <Int32>]
 [-Type <String>]
 [<CommonParameters>]

Parameters (5)

Parameter	Type	What it controls
-Identity	AuditLogSearchIdParameter	The Identity parameter specifies the GUID for an audit log search. You can run the command Get-AuditLogSearch \| Format-List Identity to display the GUIDs for all current audit log searches.
-CreatedAfter	ExDateTime	The CreatedAfter parameter filters the results to audit log searches that were created after the specified date.
-CreatedBefore	ExDateTime	The CreatedBefore parameter filters the results to audit log searches that were created before the specified date.
-ResultSize	Int32	The ResultSize parameter specifies the maximum number of results to return. If you want to return all requests that match the query, use unlimited for the value of this parameter. The default value is 1000.
-Type	String	The Type parameter specifies the type of audit log searches to return. Use the value Admin to return administrator audit log searches or use mailbox to return mailbox audit log searches. If the Type parameter isn't...

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.