locked
Search-UnifiedAuditLog only returns 90 total records RRS feed

  • Question

  • Hello,

    A few weeks back I was able to use Search-UnifiedAuditLog to export to CSV all records up to the maximum of 5000 if I set -ResultSize. Now it doesn't work. No matter what number I choose I can only get 90 total records or less if I choose a number below 90. Is there somewhere that overrides this? 

    This is what I'm running

    $startDate = (get-date).AddDays(-7).ToString('MM/dd/yyyy')
    
    $endDate = (get-date).ToString('MM/dd/yyyy')
    
    Search-UnifiedAuditLog -ResultSize 5000 -StartDate $startDate -EndDate $endDate -RecordType PowerBIAudit | Export-Csv /path/to/folder 

    I'm a global admin on our tenant and I have added myself into the roles required to run that line. It did work but now it has stopped?

    Any help on the matter will be much appreciated.

    Luke

    • Moved by Bill_Stewart Monday, January 7, 2019 8:15 PM Unanswerable drive-by question
    Monday, November 12, 2018 12:07 AM

All replies

  • Hello,

    Default value of -ResultSize is 100, are you sure you more than 90 PowerBIAudit total records betwenn your date range?

    Try to grow your search range.

    https://docs.microsoft.com/en-us/powershell/module/exchange/policy-and-compliance-audit/search-unifiedauditlog?view=exchange-ps

    Monday, November 12, 2018 10:15 AM
  • Hello,

    Thanks for your reply. 

    Yes, I can grow the search range up to the full 90 days and I still only get a total of 90 records exported.

    What originally prompted me to use this code was doing it the manual way through the admin portal stopped working a little while back. Now that has started working again and this way with the PowerShell has stopped.


    Monday, November 12, 2018 10:15 PM
  • It sounds like you may be missing a software update.  Contact MS support through the portal and they will check and fix it.  Many things similar to this have happened recently.


    \_(ツ)_/

    Tuesday, November 13, 2018 12:09 AM