Microsoft Announces Audit Logging Changes Coming to Exchange Online
Microsoft will retire old audit logging cmdlets in Exchange Online by March 2025.
Published: Jan 24, 2025
Key Takeaways:
- Microsoft will soon retire the Search-MailboxAuditLog and New-MailboxAuditLogSearch cmdlets.
- Microsoft urges transitioning to the Search-UnifiedAuditLog cmdlet.
- The old cmdlets will remain accessible for viewing and downloading data until late June 2025.
Microsoft has announced plans to retire the Search-MailboxAuditLog and New-MailboxAuditLogSearch cmdlets in Exchange Online. The company will deprecate both cmdlets in favor of the Search-UnifiedAuditLog cmdlet in March this year.
The Search-MailboxAuditLog and New-MailboxAuditLogSearch cmdlets in Microsoft Exchange Online are used for searching mailbox audit logs. The Search-MailboxAuditLog cmdlet performs a synchronous search of mailbox audit logs for one or more specified mailboxes. It shows the search results directly within the Exchange Management Shell window. This cmdlet is useful for quick searches that require immediate results.
Additionally, the New-MailboxAuditLogSearch cmdlet performs an asynchronous search of mailbox audit logs and then sends the search results through email to specified recipients. It’s useful for extensive searches where the results need to be shared with other people.
Timeline for the retirement of old Exchange Online cmdlets
Starting on March 1, 2025, new records will no longer be written to the Search-MailboxAuditLog cmdlet. Instead, all new log entries will be automatically directed to the Search-UnifiedAuditLog cmdlet, which consolidates audit logs from multiple Microsoft 365 services, such as Microsoft Teams, Exchange Online, SharePoint Online, OneDrive for Business, Microsoft Entra ID, and Power BI. This cmdlet also provides advanced filtering options, which allow admins to refine searches by criteria like users, date ranges, specific actions, IP addresses, and more.
“After the retirement, admins will be able to access Search-MailboxAuditLog and New-MailboxAuditlogSearch and make changes and downloads until late June 2025. After late June, Search-MailboxAuditLog and New-MailboxAuditlogSearch will become a static record only, and admins will no longer be able to make changes and downloads,” the company explained on the Microsoft 365 admin center.
Microsoft plans to complete the retirement of the old cmdlets for Exchange Online customers by late March. However, administrators must ensure that auditing is enabled in their Microsoft 365 tenant to use the new Search-UnifiedAuditLog cmdlet.