MC1126353: Retirement of Search-MailboxAuditLog and New-MailboxAuditLogSearch Cmdlets by End of 2025
The Search-MailboxAuditLog and New-MailboxAuditLogSearch cmdlets will retire by December 2025. After March 1, 2025, mailbox audit logs become read-only. Organizations must transition to the Search-UnifiedAuditLog cmdlet for audit access, with migration support available from June 2025.
Introduction
As part of our ongoing efforts to modernize and streamline audit logging in Exchange Online, we are retiring the Search-MailboxAuditLog and New-MailboxAuditLogSearch cmdlet. Organizations should transition to the Search-UnifiedAuditLogcmdlet for long-term audit log access and compliance.
When this will happen
- March 1, 2025: New audit log data will no longer be written to individual mailboxes.
- June 2025: Migration tools and documentation will be available to support transition.
- End of December 2025: The
Search-MailboxAuditLogandNew-MailboxAuditLogSearchcmdlets will be fully retired.
How this affects your organization
After March 1, 2025, mailbox audit log data will become static and read-only. While existing data will remain accessible for historical review, no new data will be written to mailbox audit logs. By the end of 2025, the legacy cmdlets will no longer be available, and any scripts or tools relying on them will fail.
Organizations should ensure they are using the Search-UnifiedAuditLog cmdlet for audit log access going forward. This change supports improved scalability, centralized access, and long-term retention of audit data.
What you can do to prepare
To ensure a smooth transition:
- Review your current usage of
Search-MailboxAuditLogandNew-MailboxAuditLogSearchto identify dependencies in scripts, tools, or workflows. - Engage with your legal and compliance teams to ensure regulatory requirements are met.
- Confirm that auditing is enabled for your tenant.
- Use the documentation (available June 2025) to transition to
Search-UnifiedAuditLog.
Learn more: Microsoft Exchange Online: Search-MailboxAuditLog and New-MailboxAuditLogSearch will retire
Compliance considerations
| Impacted Area | Explanation |
|---|---|
| Audit logging capabilities | Yes – This change retires legacy audit log cmdlets and shifts audit access to the unified audit log. |
| eDiscovery or Content Search | Yes – Organizations must use Search-UnifiedAuditLog for audit log searches going forward. |
| Retention policies, holds, or deletion workflows | Yes – Mailbox audit logs become static and read-only after March 2025. |
| Admin monitoring and reporting | Yes – Admins must update monitoring tools and reports to use the unified audit log. |