We will retire the Search-MailboxAuditLog and New-MailboxAuditLogSearch cmdlets in Microsoft Exchange Online starting March 1, 2025, and completing in late March 2025. After the retirement, new records will be written to Search-UnifiedAuditLog and Search-MailboxAuditLog will be accessible only as a historical record.
How this will affect your organization:
After the retirement, admins will be able to access Search-MailboxAuditLog and New-MailboxAuditlogSearch and make changes and downloads until late June 2025. After late June, Search-MailboxAuditLog and New-MailboxAuditlogSearch will become a static record only, and admins will no longer be able to make changes and downloads.
What you need to do to prepare:
This change will happen automatically by the specified dates. Please notify your users about this change, update your relevant documentation, and share the alternate capability Search-UnifiedAuditLog.
To use the Search-UnifiedAuditLog cmdlet, you must ensure auditing is enabled for your tenant.
Learn more about enabling auditing for your tenant and about the changes to these cmdlets: Microsoft Exchange Online: Search-MailboxAuditLog and New-MailboxAuditLogSearch will retire | Microsoft Community Hub