/flags/purview/search-unifiedauditlog-sessioncommand-returnlargeset
Search-UnifiedAuditLog -SessionCommand ReturnLargeSet: get more than 100 audit records
- tool
- Microsoft Purview (Security & Compliance PowerShell)
- command
- Search-UnifiedAuditLog
- flag
- -SessionCommand ReturnLargeSet | ReturnNextPreviewPage (with -SessionId)
- default
- not set: at most 100 records are returned
Search-UnifiedAuditLog -SessionCommand ReturnLargeSet -SessionId ID -ResultSize 5000 pages through the Microsoft Purview audit log beyond the default 100 records. Run the same command repeatedly with the same -SessionId: each call returns the next block, until a call returns nothing. The reference: "By default, this cmdlet returns a subset of results containing up to 100 records. Use SessionCommand parameter with the ReturnLargeSet value to exhaustively search up to 50,000 results." The cmdlet runs in Exchange Online PowerShell, so connect with Connect-ExchangeOnline.
Connect-ExchangeOnline -UserPrincipalName admin@contoso.com -ShowBanner:$false
$sid = [guid]::NewGuid().ToString()
$all = @()
do {
$page = Search-UnifiedAuditLog -StartDate '2026-10-20' -EndDate '2026-10-21' `
-RecordType SharePointFileOperation -SessionId $sid -SessionCommand ReturnLargeSet -ResultSize 5000
$all += $page
} while ($page)
$all | Sort-Object CreationDate | Export-Csv audit.csv -NoTypeInformationValues
| -SessionCommand | Order | Maximum records | Use |
|---|---|---|---|
| (not set) | sorted | 100 | quick look |
| ReturnLargeSet | unsorted | 50,000 per SessionId, paged | exports and investigations (recommended) |
| ReturnNextPreviewPage | sorted by date | 5,000 through paging or -ResultSize | small, ordered result sets |
-ResultSize sets the size of each block: "The default value is 100, maximum is 5,000." -SessionId "can be any string value you choose"; a GUID avoids collisions between parallel scripts.
Rules from the reference
- "Always use the same SessionCommand value for a given SessionId value. Don't switch between ReturnLargeSet and ReturnNextPreviewPage for the same session ID. Otherwise, the output is limited to 10,000 results."
- Sequential calls with the same session ID return "the data in sequential blocks of the size specified by ResultSize".
- ReturnLargeSet returns unsorted data; sort after collecting.
Pitfalls
- Stopping too early. Each record carries
ResultIndexandResultCount. Compare the number collected withResultCountof the first record; if they differ, the session was interrupted or more than 50,000 records exist. - 50,000 cap. For larger windows, split the time range and use one SessionId per range.
- Duplicates. Running the same window twice with different session IDs returns the same records twice; deduplicate on
Identity. - Not connected. Without a session the cmdlet does not exist yet; connect first (You must call Connect-ExchangeOnline). It also needs an audit role such as View-Only Audit Logs.
- More filters (
-UserIds,-Operations,-FreeText) are on Search-UnifiedAuditLog.
FAQ
Why does Search-UnifiedAuditLog return only 100 results?
100 is the default, and the reference says -SessionCommand is required to retrieve more than that. To page through up to 50,000 records use -SessionCommand ReturnLargeSet with the same -SessionId on every call.
Why are ReturnLargeSet results not sorted by date?
That is by design: ReturnLargeSet returns unsorted data, optimized for search latency. Sort the collected records yourself with Sort-Object CreationDate, or use ReturnNextPreviewPage, which is sorted but limited to 5,000 records.
What if my search has more than 50,000 records?
Split it into smaller time windows (for example one hour or one day per search) and run each window with its own SessionId. Microsoft's audit log search script uses that approach.