Skip to content
Browse

/commands/purview/search-unifiedauditlog

Search-UnifiedAuditLog: search the Microsoft 365 audit log with PowerShell

The commands on this page have not been executed by our verification runner yet.updated
tool
Microsoft Purview (Security & Compliance PowerShell)
versions
Exchange Online PowerShell, ExchangeOnlineManagement 3.x
os
windows, linux, macos

Search-UnifiedAuditLog searches the Microsoft Purview (Microsoft 365) audit log. Unlike most Purview cmdlets it runs in Exchange Online PowerShell, so connect with Connect-ExchangeOnline:

powershell
Connect-ExchangeOnline -UserPrincipalName admin@contoso.com
Search-UnifiedAuditLog -StartDate "10/20/2026 08:00" -EndDate "10/20/2026 18:00" -UserIds anna@contoso.com -SessionCommand ReturnLargeSet -ResultSize 5000

Without -SessionCommand the cmdlet returns at most 100 records. You need an audit role, for example the View-Only Audit Logs or Audit Logs role in Exchange Online.

Filter the results

ParameterUse
-StartDate / -EndDateRequired. Without a time, midnight is used; the same date for both returns nothing
-UserIdsAccounts that performed the action
-RecordTypeWorkload, for example ExchangeAdmin, SharePointFileOperation, AzureActiveDirectory
-OperationsActivities, for example FileAccessed, MailItemsAccessed, New-InboxRule
-ObjectIdsThe object acted on, for example a file URL
-FreeTextText search in the record
-ResultSizeUp to 5000 per call (default 100)

The values allowed in -Operations depend on the record type; Microsoft lists them in "Audited activities".

More than 5000 records

Repeat the same command with the same -SessionId until it returns nothing. With ReturnLargeSet you can page through up to 50,000 unsorted records:

powershell
$sid = [guid]::NewGuid().ToString()
$all = @()
do {
  $page = Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) `
    -RecordType SharePointFileOperation -Operations FileDeleted `
    -SessionId $sid -SessionCommand ReturnLargeSet -ResultSize 5000
  $all += $page
} while ($page)
$all | Select-Object CreationDate,UserIds,Operations -First 20

ReturnNextPreviewPage returns records sorted by date but stops at 5000. Do not switch between the two values within one session ID, or output is limited to 10,000 results.

Each record's details are JSON in the AuditData property: $all | ForEach-Object { $_.AuditData | ConvertFrom-Json }.

Is auditing on?

powershell
Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled

True (the default) means activities are recorded. To turn it on: Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true.

Sources

Related pages

commands · purviewNew-ComplianceSearch and Start-ComplianceSearch: run a Purview content search in PowerShellCreate the search with New-ComplianceSearch, run it with Start-ComplianceSearch, read counts with Get-ComplianceSearch. Connect with -EnableSearchOnlySession.commands · exchange-onlineGet-MessageTraceV2: message trace in Exchange Online PowerShellGet-MessageTraceV2 searches 90 days of mail, 10 days per query, up to 5000 results. Filter by sender, recipient or status; page with StartingRecipientAddress.commands · purviewConnect-IPPSSession: connect to Security & Compliance PowerShell (Purview)Connect-IPPSSession from ExchangeOnlineManagement opens Security & Compliance PowerShell for Purview cmdlets; add -EnableSearchOnlySession for eDiscovery.flags · purviewSearch-UnifiedAuditLog -SessionCommand ReturnLargeSet: get more than 100 audit recordsSearch-UnifiedAuditLog returns 100 records by default. -SessionCommand ReturnLargeSet with one SessionId pages up to 50,000; rules, a loop and the 5,000 limit.