Commands › Exchange Online

Search-AdminAuditLog

Exchange Online ExchangeOnlineManagement Search-*

> [!NOTE] > This cmdlet has been deprecated in the cloud-based service. To access audit log data, use the Search-UnifiedAuditLog cmdlet. For more information, see this blog post: <https://aka.ms/AdminAuditCmdletBlog>. Use the Search-AdminAuditLog cmdlet to search the contents of the administrator audit log. Administrator audit logging records when a user or administrator makes a change in your organization (in the Exchange admin center or by using cmdlets).

Quick start script

# Search-AdminAuditLog — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Run and inspect
Search-AdminAuditLog | Format-List

# 3. Export for evidence / drift tracking
Search-AdminAuditLog | Export-Clixml .\AdminAuditLog-$(Get-Date -Format yyyyMMdd).xml

Syntax

Search-AdminAuditLog
 [-Cmdlets <MultiValuedProperty>]
 [-DomainController <Fqdn>]
 [-EndDate <ExDateTime>]
 [-ExternalAccess <Boolean>]
 [-IsSuccess <Boolean>]
 [-ObjectIds <MultiValuedProperty>]
 [-Parameters <MultiValuedProperty>]
 [-ResultSize <Int32>]
 [-StartDate <ExDateTime>]
 [-StartIndex <Int32>]
 [-UserIds <MultiValuedProperty>]
 [<CommonParameters>]

Parameters (11)

Parameter	Type	What it controls
-Cmdlets	MultiValuedProperty	The Cmdlets parameter filters the results by the cmdlets that were used. You can specify multiple cmdlets separated by commas.
-DomainController	Fqdn	The DomainController parameter specifies the domain controller that's used by this cmdlet to read data from or write data to Active Directory. You identify the domain controller by its fully qualified domain name...
-EndDate	ExDateTime	The EndDate parameter specifies the end date of the date range.
-ExternalAccess	Boolean	The ExternalAccess parameter filters the results by changes that were made (cmdlets that were run) by users outside of your organization. Valid values are:
-IsSuccess	Boolean	The IsSuccess parameter filters the results by whether the changes were successful. Valid values are:
-ObjectIds	MultiValuedProperty	The ObjectIds parameter filters the results by the object that was modified (the mailbox, public folder, Send connector, transport rule, accepted domain, etc. that the cmdlet operated on). A valid value depends on...
-Parameters	MultiValuedProperty	The Parameters parameter filters the results by the parameters that were used. You can only use this parameter with the Cmdlets parameter (you can't use it by itself). You can specify multiple parameters separated by commas.
-ResultSize	Int32	The ResultSize parameter specifies the maximum number of results to return. The default value is 1000.
-StartDate	ExDateTime	The StartDate parameter specifies the start date of the date range.
-StartIndex	Int32	The StartIndex parameter specifies the position in the result set where the displayed results start.
-UserIds	MultiValuedProperty	The UserIds parameter filters the results by the user who made the change (who ran the cmdlet).

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.