ZEKASTRA

CloudIntermediateCloud records

Microsoft 365 unified audit log

Microsoft 365 audit records searched in the Microsoft Purview portal; retention depends on the license and times are in UTC.

01Location

  • Microsoft Purview portal: Audit solution, Search page
  • Exchange Online PowerShell: Search-UnifiedAuditLog

02Questions it answers

  • Which user or application performed an action, and when in UTC?
  • Is the event within the retention period for this tenant's license?
  • Did the export stay within the row limit of the audit tier?

03Format and versions

FormatSearch jobs in the Purview portal; results can be exported to CSV. Export is limited to 50,000 rows for Audit (Standard) and 1,000,000 rows for Audit (Premium).
Applies toRetention and export limits depend on the license and audit tier; the figures are from the page as checked on 25 Ekim 2026.

04Key fields

FieldWhat it tells you
Audit tierAudit (Standard), Audit (Premium) or the legacy Audit (Standard) logs; export row limits differ between them.
RetentionE5 licenses keep Microsoft Entra ID, Exchange and SharePoint activity for one year by default; other Microsoft 365 licenses keep audit records for 180 days.
Legacy retentionAudit (Standard) logs generated before 17 Ekim 2023 are kept for 90 days, according to the page.

05Timestamps

FieldEncodingNote
Date and timeUTCDate and time on the search results are presented in Coordinated Universal Time (UTC).

Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.

06Examination workflow

  1. Record the tenant, the license and the audit tier before searching, because retention and export limits depend on them.
  2. Search a fixed time window in UTC, note the search job, and export the results to CSV; keep the export unchanged and record its hash.
  3. Compare the row count with the limit for the audit tier; if the limit was reached, split the search into smaller time windows and repeat it.

07Interpretation pitfalls

  • Records older than the retention period are not available in the portal, so a missing record does not prove that the activity did not happen.
  • Portal search and the Search-UnifiedAuditLog cmdlet are different routes; the cmdlet needs Exchange Online PowerShell and its own permissions.
  • Access to a tenant's logs depends on authority granted by the account owner; this tool does not grant that authority.

09Sources

  1. Audit log search (Microsoft Purview) Microsoft Learn · checked 2026-10-25

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.

Contact page →