💡 Our Technical Review in summary
Summary
- Microsoft is retiring the legacy
Search-MailboxAuditLogandNew-MailboxAuditLogSearchcmdlets in Exchange Online as part of a modernization effort to centralize audit logging. - Organizations must transition to the
Search-UnifiedAuditLogcmdlet for all audit log access, compliance, and reporting needs. - The transition follows a phased timeline, beginning with data becoming static in March 2025 and ending with full cmdlet deprecation by the end of December 2025.
Impact
- Data Availability: After March 1, 2025, mailbox-level audit logs will stop receiving new data. While historical data remains readable, no new events will be recorded in the legacy location.
- Script Failure: Any administrative scripts, automated tools, or third-party integrations relying on the legacy cmdlets will fail once the retirement is finalized at the end of 2025.
- Compliance & eDiscovery: Historical audit searches for compliance or legal reasons will require transitioning to the Unified Audit Log (UAL) framework to ensure visibility into current activities.
- Centralization: This change moves audit data away from individual mailbox databases to a centralized tenant-wide store, improving scalability and log retention management.
Action Required
- Audit Scripts: Perform a comprehensive review of all PowerShell scripts and automation workflows. Replace any instances of
Search-MailboxAuditLogorNew-MailboxAuditLogSearchwithSearch-UnifiedAuditLog. - Verify Tenant Auditing: Ensure that Unified Auditing is enabled for your Microsoft 365 tenant to prevent gaps in data logging.
- Monitor Migration Resources: Look for official Microsoft migration tools and updated documentation scheduled for release in June 2025 to assist with the transition.
- Stakeholder Coordination: Inform legal, security, and compliance teams of the shift to the Unified Audit Log to ensure that data retention policies and investigative procedures are updated accordingly.
- Historical Review: Conduct any necessary mailbox-specific historical exports before the end of 2025 to ensure continuity of records if required by specific local regulations.
Microsoft Official Update
Service: N/A
Category: planForChange
Severity: normal
Introduction
As part of our ongoing efforts to modernize and streamline audit logging in Exchange Online, we are retiring the Search-MailboxAuditLog and New-MailboxAuditLogSearch cmdlet. Organizations should transition to the Search-UnifiedAuditLogcmdlet for long-term audit log access and compliance.
When this will happen
- March 1, 2025: New audit log data will no longer be written to individual mailboxes.
- June 2025: Migration tools and documentation will be available to support transition.
- End of December 2025: The
Search-MailboxAuditLogandNew-MailboxAuditLogSearchcmdlets will be fully retired.
How this affects your organization
After March 1, 2025, mailbox audit log data will become static and read-only. While existing data will remain accessible for historical review, no new data will be written to mailbox audit logs. By the end of 2025, the legacy cmdlets will no longer be available, and any scripts or tools relying on them will fail.
Organizations should ensure they are using the Search-UnifiedAuditLog cmdlet for audit log access going forward. This change supports improved scalability, centralized access, and long-term retention of audit data.
What you can do to prepare
To ensure a smooth transition:
- Review your current usage of
Search-MailboxAuditLogandNew-MailboxAuditLogSearchto identify dependencies in scripts, tools, or workflows. - Engage with your legal and compliance teams to ensure regulatory requirements are met.
- Confirm that auditing is enabled for your tenant.
- Use the documentation (available June 2025) to transition to
Search-UnifiedAuditLog.
Learn more: Microsoft Exchange Online: Search-MailboxAuditLog and New-MailboxAuditLogSearch will retire
Compliance considerations
| Impacted Area | Explanation |
|---|---|
| Audit logging capabilities | Yes – This change retires legacy audit log cmdlets and shifts audit access to the unified audit log. |
| eDiscovery or Content Search | Yes – Organizations must use Search-UnifiedAuditLog for audit log searches going forward. |
| Retention policies, holds, or deletion workflows | Yes – Mailbox audit logs become static and read-only after March 2025. |
| Admin monitoring and reporting | Yes – Admins must update monitoring tools and reports to use the unified audit log. |
