Search-UnifiedAuditLogCustom is an enhanced wrapper around the native Search-UnifiedAuditLog cmdlet, providing additional features such as a user-friendly GUI for constructing search queries, simplified output formatting, and integration with the Microsoft 365 audit operations catalog.
This function allows administrators and security professionals to perform more efficient and targeted searches of the Microsoft 365 Unified Audit Log.
It includes a helper GUI that enables users to easily select operations from the official Microsoft Learn catalog, specify date ranges, user filters, and other parameters without needing to remember complex cmdlet syntax.
The output can be returned in a simplified format that flattens nested JSON structures for easier analysis and export.
This is particularly useful for security investigations, compliance audits, and general monitoring of activities across Microsoft 365 services.
This example searches the Unified Audit Log for “UserLoggedIn” and “FileAccessed” operations that occurred in the last 7 days, and returns the results in a simplified format.
An array of operation names to filter the search.
These can be selected from the helper GUI, which loads the catalog of operations from Microsoft Learn.
Users can also enter raw cmdlet names (e.g., New-TransportRule) to filter by specific operations.
When specified, the output will be processed to flatten nested JSON structures into a simpler format.
This is ideal for exporting to CSV or performing quick analysis without dealing with complex nested properties.
When specified, opens a graphical user interface to assist in constructing the search query with user-friendly controls and operation selection.
The operations list is populated from the Microsoft Learn catalog of audit log activities, allowing users to easily find and select relevant operations for their search.
Make sure to have access to the Microsoft Learn page for audit log activities to load the operations catalog successfully (https://learn.microsoft.com/en-us/purview/audit-log-activities).
Size (in days) of each sub-window used to split the StartDate/EndDate range.
Defaults to 7.
The function loops over the full range one chunk at a time and uses session pagination inside each chunk,
which avoids the server-side ‘Search duration too long’ error encountered on very wide windows.
Lower this value (e.g.
1 or 3) if a chunk itself returns the ‘too long’ error.
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.
