Has anyone noticed unusual behavior with Search-UnifiedAuditLog in Exchange Online recently? An audit script that had worked reliably until last month suddenly stopped returning records for one of our users, even though the events were visible elsewhere. Basic searches still return results, but adding the -SessionId parameter produces an empty result set. This makes it difficult to retrieve more than 5,000 records across larger date ranges. I reproduced the behavior across several tenants, so I'm wondering whether this is a service-side issue. For now, I've shortened the query windows in my automation to stay under the limit. How are others handling large-scale audit log collection?
1 Answer
This sounds like a service-side issue with the session-based paging behavior. As an alternative, Microsoft Graph’s security audit APIs may work better for large result sets: create an audit log query with auditLogQuery, then retrieve its records through auditLogRecords and follow the OData paging links. You can authenticate with the Microsoft.Graph.Authentication module and send the requests with Invoke-MgGraphRequest.
Thanks, I’ll investigate the Graph approach and see whether it handles the larger result sets more reliably.