Commands › Exchange Online

Search-UnifiedAuditLog

Exchange Online ExchangeOnlineManagement Search-*

Search the unified audit log. This log contains events from Exchange Online, SharePoint, OneDrive, Microsoft Entra ID, Microsoft Teams, Power BI, and other Microsoft 365 services. You can search for all events in a specified date range, or you can filter the results based on specific criteria, such as the user who performed the action, the action, or the target object. **Note**: By default, this cmdlet returns a subset of results containing up to 100 records. Use SessionCommand parameter with the ReturnLargeSet value to exhaustively search up to 50,000 results. The SessionCommand parameter cau

Quick start script

# Search-UnifiedAuditLog — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Run and inspect
Search-UnifiedAuditLog -EndDate <ExDateTime> -StartDate <ExDateTime> | Format-List

# 3. Export for evidence / drift tracking
Search-UnifiedAuditLog | Export-Clixml .\UnifiedAuditLog-$(Get-Date -Format yyyyMMdd).xml

Syntax

Search-UnifiedAuditLog -EndDate <ExDateTime> -StartDate <ExDateTime>
 [-Formatted]
 [-FreeText <String>]
 [-HighCompleteness]
 [-IPAddresses <String[]>]
 [-LegacyFlow]
 [-LongerRetentionEnabled <String>]
 [-ObjectIds <String[]>]
 [-Operations <String[]>]
 [-RecordType <AuditRecordType>]
 [-ResultSize <Int32>]
 [-SessionCommand <UnifiedAuditSessionCommand>]
 [-SessionId <String>]
 [-SiteIds <String[]>]
 [-UserIds <String[]>]
 [<CommonParameters>]

Parameters (16)

Parameter	Type	Required	What it controls
-EndDate	ExDateTime	yes	The EndDate parameter specifies the end date of the date range. Entries are stored in the unified audit log in Coordinated Universal Time (UTC). If you specify a date/time value without a time zone, the value is in UTC.
-StartDate	ExDateTime	yes	The StartDate parameter specifies the start date of the date range. Entries are stored in the unified audit log in Coordinated Universal Time (UTC). If you specify a date/time value without a time zone, the value is in UTC.
-Formatted	SwitchParameter		The Formatted switch causes attributes that are normally returned as integers (for example, RecordType and Operation) to be formatted as descriptive strings. You don't need to specify a value with this switch.
-FreeText	String		The FreeText parameter filters the log entries by the specified text string. If the value contains spaces, enclose the value in quotation marks (").
-HighCompleteness	SwitchParameter		Note: This parameter is currently in Preview, isn't available in all organizations, and is subject to change.
-IPAddresses	String[]		The IPAddresses parameter filters the log entries by the specified IP addresses. You specify multiple IP addresses separated by commas.
-LegacyFlow	SwitchParameter		{{ Fill LegacyFlow Description }}
-LongerRetentionEnabled	String		{{ Fill LongerRetentionEnabled Description }}
-ObjectIds	String[]		The ObjectIds parameter filters the log entries by object ID. The object ID is the target object that was acted upon, and depends on the RecordType and Operations values of the event.
-Operations	String[]		The Operations parameter filters the log entries by operation. The available values for this parameter depend on the RecordType value. For a list of the available values for this parameter, see [Audited...
-RecordType	AuditRecordType		The RecordType parameter filters the log entries by record type. For details about the available values, see...
-ResultSize	Int32		The ResultSize parameter specifies the maximum number of results to return. The default value is 100, maximum is 5,000.
-SessionCommand	UnifiedAuditSessionCommand		The SessionCommand parameter specifies how much information is returned and how it's organized. This parameter is required if you want to retrieve more than the default limit of 100 results. Valid values are:
-SessionId	String		The SessionId parameter specifies an ID string to identify a command (the cmdlet and its parameters) that's run multiple times to return paged data. The SessionId can be any string value you choose.
-SiteIds	String[]		The SiteIds parameter filters the log entries by the SharePoint SiteId (GUID). You can enter multiple values separated by commas: `Value1, Value2,...ValueN`.
-UserIds	String[]		The UserIds parameter filters the log entries by the account (UserPrincipalName) of the user who performed the action. For example, laura@contoso.onmicrosoft.com.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.