Commands › Exchange Online

New-AdminAuditLogSearch

Exchange Online ExchangeOnlineManagement New-*

> [!NOTE] > This cmdlet has been deprecated in the cloud-based service. To access audit log data, use the Search-UnifiedAuditLog cmdlet. For more information, see this blog post: <https://aka.ms/AdminAuditCmdletBlog>. Use the New-AdminAuditLogSearch cmdlet to search the contents of the administrator audit log and send the results to one or more mailboxes that you specify.

Quick start script

# New-AdminAuditLogSearch — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-AdminAuditLogSearch
$before | Format-List

# 3. Make the change (dry run first)
New-AdminAuditLogSearch -EndDate <ExDateTime> -StartDate <ExDateTime> -StatusMailRecipients <MultiValuedProperty> -WhatIf
New-AdminAuditLogSearch -EndDate <ExDateTime> -StartDate <ExDateTime> -StatusMailRecipients <MultiValuedProperty>

# 4. Verify and diff
$after = Get-AdminAuditLogSearch
Compare-Object ($before | Out-String) ($after | Out-String)

Syntax

New-AdminAuditLogSearch -EndDate <ExDateTime> -StartDate <ExDateTime> -StatusMailRecipients <MultiValuedProperty>
 [-Cmdlets <MultiValuedProperty>]
 [-Confirm]
 [-DomainController <Fqdn>]
 [-ExternalAccess <Boolean>]
 [-Name <String>]
 [-ObjectIds <MultiValuedProperty>]
 [-Parameters <MultiValuedProperty>]
 [-UserIds <MultiValuedProperty>]
 [-WhatIf]
 [<CommonParameters>]

Parameters (12)

Parameter	Type	Required	What it controls
-EndDate	ExDateTime	yes	The EndDate parameter specifies the end date of the date range.
-StartDate	ExDateTime	yes	The StartDate parameter specifies the start date of the date range.
-StatusMailRecipients	MultiValuedProperty	yes	The StatusMailRecipients parameter specifies the recipients that should receive the administrator audit log report. The recipient must be a valid SMTP address.
-Cmdlets	MultiValuedProperty		The Cmdlets parameter specifies the cmdlets you want to search for in the administrator audit log. Only the log entries that contain the cmdlets you specify are returned.
-Confirm	SwitchParameter		The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on whether the cmdlet requires confirmation before proceeding.
-DomainController	Fqdn		The DomainController parameter specifies the domain controller that's used by this cmdlet to read data from or write data to Active Directory. You identify the domain controller by its fully qualified domain name...
-ExternalAccess	Boolean		The ExternalAccess parameter returns only audit log entries for cmdlets that were run by a user outside of your organization. In use this parameter to return audit log entries for cmdlets run by Microsoft datacenter...
-Name	String		The Name parameter specifies the name of the administrator audit log search. The name is shown in the subject line of the audit log report email message.
-ObjectIds	MultiValuedProperty		The ObjectIds parameter specifies that only administrator audit log entries that contain the specified changed objects should be returned. This parameter accepts a variety of objects, such as mailboxes, aliases, Send...
-Parameters	MultiValuedProperty		The Parameters parameter specifies the parameters you want to search for in the administrator audit log. Only the log entries that contain the parameters you specify are returned. You can only use this parameter if...
-UserIds	MultiValuedProperty		The UserIds parameter specifies that only the administrator audit log entries that contain the specified ID of the user who ran the cmdlet should be returned.
-WhatIf	SwitchParameter		The WhatIf switch doesn't work in Security & Compliance PowerShell.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.