Converting PowerShell Scripts from Search-UnifiedAuditLog

[u/Unlikely_Tie1172]

Investigating the work necessary to convert PowerShell scripts based on the Search-UnifiedAuditLog cmdlet to use the AuditLogQuery Graph API shows that it’s not easy. Running audit jobs is a multi-stage process rather than running a simple cmdlet. Parameter values are now passed in a request body or different named parameters, and the properties output in the AuditData payload use a different format. This is definitely not a drop-in exercise, so it’s time to get ready by finding scripts that need to be converted.

https://office365itpros.com/2026/10/27/auditlogquery-conversion/

[u/13159daysold]

Hopefully they improve it in the next year...