MC1310672: Microsoft Purview: Update to ResultCount parameter in the Search-UnifiedAuditLog cmdlet

[Introduction]

To improve performance and provide better visibility into query progress, we are updating the behavior of the ResultCount parameter for the Search-UnifiedAuditLog cmdlet in Microsoft Purview Audit.

Previously, the ResultCount parameter returned the total number of results expected from a query. With this update, ResultCount will display a running count of results as they are retrieved in real time.

We are also introducing a new boolean property, AuditSearchRequestMetadata.moreRecordsAvailable , which indicates whether additional records are still being retrieved.

Together, these updates provide administrators with improved transparency into audit log search progress and better support for script and automation scenarios.

[When this will happen]

• General Availability (Worldwide, GCC): We began rolling out in mid-May 2026 and expect to complete bylate May 2026.
• General Availability (GCC High, DoD): We will begin rolling out in early June 2026 and expect to complete by late June 2026.

[How this affects your organization]

Who is affected

• Administrators who use Microsoft Purview Audit
• Administrators running the Search-UnifiedAuditLog cmdlet in PowerShell
• Organizations withscripts or automation that rely on audit log search results

What will happen

• The ResultCount parameter will now display a running count of results as they are retrieved during query execution.
• A new boolean property, AuditSearchRequestMetadata.moreRecordsAvailable , will indicate whether additional records are still being retrieved.
• While the query is running:
  • ResultCount shows the number of records retrieved so far.
  • moreRecordsAvailable is set to true.
• When the query completes:
  • ResultCount reflects the final total number of results.
  • moreRecordsAvailable is set to false.
• This feature is enabled by default.
• There is no change to audit log data or retention.
• Existing scripts that rely on ResultCount representing a final total before completion may require updates.

[What you can do to prepare]

• Review existing scripts and automation that rely on ResultCount to determine total results.
• Update scripts to use AuditSearchRequestMetadata.moreRecordsAvailable to confirm when queries are complete.
• Adjust pagination or query logic to incorporate a check for AuditSearchRequestMetadata.moreRecordsAvailable to reliably determine whether more records remain.
• Test audit log searches and automation during the rollout window from mid-May through late May 2026.
• If you run Search-UnifiedAuditLog manually in PowerShell and review results interactively, no changes are needed. You will benefit from improved real-time progress visibility.

Learn more:

• Learn about auditing solutions in Microsoft Purview | Microsoft Purview | Microsoft Learn
• Search-UnifiedAuditLog | policy-and-compliance-audit | ExchangePowerShell | Microsoft Learn

If you have questions or need assistance, contact Microsoft Support.

[Compliance considerations]