Queries Microsoft 365 audit records from PowerShell (Exchange Online), filtered by date, user, activity or object. Large programmatic exports are better done with the Management Activity API.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Search-UnifiedAuditLog in context, with comparison tables and the common traps.
Terms in this definition
- Microsoft 365
Formerly Office 365, Microsoft's software-as-a-service productivity suite. A Microsoft Entra tenant provides its identity, and its data is not governed by Azure RBAC.
- Audit
Policy effect that lets a request proceed but flags the resource as non-compliant and logs a warning to the activity log. Microsoft suggests beginning there and later moving to something enforcing, like Deny.
- Exchange Online
Microsoft 365's hosted service for mail, calendars and contacts. Defender for Office 365 protects these mailboxes.
- Chat message roles
Labels on chat messages: instructions go under system, the person's input under user, the model's previous answers under assistant, and results returned by a called tool under tool (or function).
- API
Short for application programming interface: a contract that client code calls programmatically, for example a web API secured with tokens or the Files, Images or Responses APIs.