check before: 2025-12-30
Product:
eDiscovery, Exchange
Platform:
Online, World tenant
Status:
Change type:
User impact, Retirement
Links:
Details:
Summary:
The Search-MailboxAuditLog and New-MailboxAuditLogSearch cmdlets will retire by December 2025. After March 1, 2025, mailbox audit logs become read-only. Organizations must transition to the Search-UnifiedAuditLog cmdlet for audit access, with migration support available from June 2025.
Details:
Introduction
As part of our ongoing efforts to modernize and streamline audit logging in Exchange Online, we are retiring the Search-MailboxAuditLog and New-MailboxAuditLogSearch cmdlet. Organizations should transition to the Search-UnifiedAuditLogcmdlet for long-term audit log access and compliance.
When this will happen
March 1, 2025: New audit log data will no longer be written to individual mailboxes.
June 2025: Migration tools and documentation will be available to support transition.
End of December 2025: The Search-MailboxAuditLog and New-MailboxAuditLogSearch cmdlets will be fully retired.
Change Category:
XXXXXXX ... free basic plan only
Scope:
XXXXXXX ... free basic plan only
Release Phase:
Created:
2025-08-01
updated:
2025-08-01
Task Type
XXXXXXX ... free basic plan only
Docu to Check
XXXXXXX ... free basic plan only
MS How does it affect me
XXXXXXX ... free basic plan only
MS Preperations
XXXXXXX ... free basic plan only
MS Urgency
XXXXXXX ... free basic plan only
MS workload name
XXXXXXX ... free basic plan only
summary for non-techies**
The Search-MailboxAuditLog and New-MailboxAuditLogSearch cmdlets in Exchange Online will be retired by the end of 2025, requiring organizations to transition to the Search-UnifiedAuditLog cmdlet for audit logging, with migration tools and documentation available from June 2025 to facilitate this change.
Direct effects for Operations**
Audit Logging Capabilities
Retirement of legacy cmdlets will limit organizations' ability to access real-time mailbox audit logs, impacting compliance and monitoring processes.
- roles: Compliance Officer, IT Administrator
- references: https://techcommunity.microsoft.com/blog/microsoft-security-blog/microsoft-exchange-online-search-mailboxauditlog-and-new-mailboxauditlogsearch-w/4366310
eDiscovery Processes
Organizations will need to adapt their eDiscovery workflows to utilize the Search-UnifiedAuditLog, potentially leading to delays in legal investigations if not prepared.
- roles: Legal Team, IT Administrator
- references: https://techcommunity.microsoft.com/blog/microsoft-security-blog/microsoft-exchange-online-search-mailboxauditlog-and-new-mailboxauditlogsearch-w/4366310
Retention Policies
With mailbox audit logs becoming static and read-only, organizations may face challenges in maintaining compliance with retention policies if they do not transition in time.
- roles: Compliance Officer, Data Governance Manager
- references: https://techcommunity.microsoft.com/blog/microsoft-security-blog/microsoft-exchange-online-search-mailboxauditlog-and-new-mailboxauditlogsearch-w/4366310
Admin Monitoring and Reporting
Existing monitoring tools and reports relying on the retired cmdlets will fail, leading to gaps in administrative oversight and potential security risks.
- roles: IT Administrator, Security Analyst
- references: https://techcommunity.microsoft.com/blog/microsoft-security-blog/microsoft-exchange-online-search-mailboxauditlog-and-new-mailboxauditlogsearch-w/4366310
User Experience
Users may experience delays in audit log access and potential compliance issues if the transition to the new cmdlet is not managed effectively.
- roles: End Users, IT Support
- references: https://techcommunity.microsoft.com/blog/microsoft-security-blog/microsoft-exchange-online-search-mailboxauditlog-and-new-mailboxauditlogsearch-w/4366310
Configutation Options**
XXXXXXX ... paid membership only
Potentional Risks**
XXXXXXX ... paid membership only
IT Security**
XXXXXXX ... paid membership only
explanation for non-techies**
XXXXXXX ... free basic plan only
** AI generated content. This information must be reviewed before use.
a free basic plan is required to see more details. Sign up here
A cloudsocut.one plan is required to see all the changed details. If you are already a customer, choose login.
If you are new to cloudscout.one please choose a plan.
Last updated 5 months ago ago
