Microsoft to Retire Search-UnifiedAuditLog Cmdlet in October 2027
Microsoft is deprecating the Search-UnifiedAuditLog PowerShell cmdlet in favor of the new AuditLogQuery Graph API, requiring organizations to migrate their reporting tools by October 2027.
Microsoft is retiring the Search-UnifiedAuditLog PowerShell cmdlet in October 2027. This retirement marks the end of the traditional method for programmatic audit log access in Microsoft 365.
The transition coincides with the general availability of the AuditLogQuery Graph API. Organizations using existing PowerShell scripts for tenant activity monitoring and reporting must now migrate their systems.
You need to refactor automation and reporting tools to use the AuditLogQuery Graph API before the October 2027 deadline. This migration requires reviewing codebase dependencies and implementing new authentication and data retrieval workflows required by the Graph interface.
The three-year planning window gives teams time to reallocate development resources and handle the technical overhead of moving away from the established cmdlet to the updated data access standards.