check before: 2025-03-01
Product:
Exchange
Platform:
Online, World tenant
Status:
Change type:
Admin impact, Retirement
Links:
Details:
Summary:
The cmdlets `Search-MailboxAuditLog` and `New-MailboxAuditLogSearch` in Microsoft Exchange Online will retire in March 2025. Admins can access and modify records until late June 2025, after which they become static. Users should be notified, documentation updated, and auditing enabled to use `Search-UnifiedAuditLog`.
Details:
We will retire the Search-MailboxAuditLog and New-MailboxAuditLogSearch cmdlets in Microsoft Exchange Online starting March 1, 2025, and completing in late March 2025. After the retirement, new records will be written to Search-UnifiedAuditLog and Search-MailboxAuditLog will be accessible only as a historical record.
Change Category:
XXXXXXX ... free basic plan only
Scope:
XXXXXXX ... free basic plan only
Release Phase:
Created:
2025-01-18
updated:
2025-01-18
Task Type
XXXXXXX ... free basic plan only
Docu to Check
XXXXXXX ... free basic plan only
MS How does it affect me
XXXXXXX ... free basic plan only
MS Preperations
XXXXXXX ... free basic plan only
MS Urgency
XXXXXXX ... free basic plan only
MS workload name
XXXXXXX ... free basic plan only
summary for non-techies**
XXXXXXX ... free basic plan only
Direct effects for Operations**
Retirement of Cmdlets
The retirement of Search-MailboxAuditLog and New-MailboxAuditLogSearch will limit admins' ability to access and modify mailbox audit logs, potentially leading to compliance issues if not prepared.
- roles: Exchange Admin, Compliance Officer
- references: https://techcommunity.microsoft.com/blog/microsoftsecurityandcompliance/microsoft-exchange-online-search-mailboxauditlog-and-new-mailboxauditlogsearch-w/4366310
Static Records
Post-retirement, the cmdlets will only provide static records, which may hinder investigations and audits if users are not informed and prepared for the change.
- roles: Exchange Admin, Security Analyst
- references: https://techcommunity.microsoft.com/blog/microsoftsecurityandcompliance/microsoft-exchange-online-search-mailboxauditlog-and-new-mailboxauditlogsearch-w/4366310
Auditing Requirements
Failure to enable auditing for the tenant before the cmdlet retirement may result in loss of critical audit data, impacting compliance and security monitoring.
- roles: Exchange Admin, IT Security Manager
- references: https://techcommunity.microsoft.com/blog/microsoftsecurityandcompliance/microsoft-exchange-online-search-mailboxauditlog-and-new-mailboxauditlogsearch-w/4366310
User Notification
Not notifying users about the change may lead to confusion and lack of awareness regarding the new auditing processes, affecting user experience.
- roles: IT Support, End User
- references: https://techcommunity.microsoft.com/blog/microsoftsecurityandcompliance/microsoft-exchange-online-search-mailboxauditlog-and-new-mailboxauditlogsearch-w/4366310
Documentation Updates
If documentation is not updated to reflect the changes, users may struggle to adapt to the new cmdlet Search-UnifiedAuditLog, leading to operational inefficiencies.
- roles: Technical Writer, Exchange Admin
- references: https://techcommunity.microsoft.com/blog/microsoftsecurityandcompliance/microsoft-exchange-online-search-mailboxauditlog-and-new-mailboxauditlogsearch-w/4366310
Configutation Options**
XXXXXXX ... paid membership only
Potentional Risks**
XXXXXXX ... paid membership only
IT Security**
XXXXXXX ... paid membership only
explanation for non-techies**
XXXXXXX ... free basic plan only
** AI generated content. This information must be reviewed before use.
a free basic plan is required to see more details. Sign up here
A cloudsocut.one plan is required to see all the changed details. If you are already a customer, choose login.
If you are new to cloudscout.one please choose a plan.
Last updated 2 months ago
