{
  "$type": "site.standard.document",
  "bskyPostRef": {
    "cid": "bafyreihyycc6stpmwfvyjzxqvwte2o2jorm4pxj7ap247hisvnn2lobklu",
    "uri": "at://did:plc:xxrzfynfiasdpbxteqxi4jgq/app.bsky.feed.post/3mltzpqzs2td2"
  },
  "description": "Microsoft Purview updates the Search-UnifiedAuditLog cmdlet's ResultCount parameter to show a running count of results in real time, adding a new boolean property, AuditSearchRequestMetadata.moreRecordsAvailable, to indicate if more records remain. This improves query progress visibility and affe...",
  "path": "/m365-message-center/message/mc1310672/",
  "publishedAt": "2026-05-15T00:00:12.000Z",
  "site": "https://blog.tophhie.cloud",
  "tags": [
    "Learn about auditing solutions in Microsoft Purview | Microsoft Purview | Microsoft Learn",
    "Search-UnifiedAuditLog | policy-and-compliance-audit | ExchangePowerShell | Microsoft Learn"
  ],
  "textContent": "**[Introduction]**\n\nTo improve performance and provide better visibility into query progress, we are updating the behavior of the **ResultCount** parameter for the **Search-UnifiedAuditLog cmdlet** in _Microsoft Purview Audit_.\n\nPreviously, the **ResultCount** parameter returned the total number of results expected from a query. With this update, **ResultCount** **will display a running count of results** as they are retrieved in _real time_.\n\nWe are also introducing a new boolean property, **AuditSearchRequestMetadata.moreRecordsAvailable** , which indicates whether additional records are still being retrieved.\n\nTogether, these updates provide administrators with improved transparency into audit log search progress and better support for script and automation scenarios.\n\n**[When this will happen]**\n\n  * **General Availability (Worldwide, GCC):** We began rolling out in **mid-May 2026** and expect to complete by**late May 2026**.\n  * **General Availability (GCC High, DoD):** We will begin rolling out in **early June 2026** and expect to complete by **late June 2026**.\n\n\n\n**[How this affects your organization]**\n\n_Who is affected_\n\n  * Administrators who use **Microsoft Purview Audit**\n  * Administrators running the **Search-UnifiedAuditLog cmdlet** in _PowerShell_\n  * Organizations with**scripts or automation that rely on audit log search results**\n\n\n\n _What will happen_\n\n  * The **ResultCount parameter** will now display a running count of results as they are retrieved during query execution.\n  * A new boolean property, **AuditSearchRequestMetadata.moreRecordsAvailable** , will indicate whether additional records are still being retrieved.\n  * While the query is running:\n    * **ResultCount** shows the number of records retrieved so far.\n    * **moreRecordsAvailable** is set to **_true_**.\n  * When the query completes:\n    * **ResultCount** reflects the final total number of results.\n    * **moreRecordsAvailable** is set to **_false_**.\n  * This feature is **enabled by default**.\n  * There is no change to audit log data or retention.\n  * Existing scripts that rely on **ResultCount** representing a final total before completion may require updates.\n\n\n\n**[What you can do to prepare]**\n\n  * Review existing scripts and automation that rely on **ResultCount** to determine total results.\n  * Update scripts to use **AuditSearchRequestMetadata.moreRecordsAvailable** to confirm when queries are complete.\n  * Adjust pagination or query logic to incorporate a check for **AuditSearchRequestMetadata.moreRecordsAvailable** to reliably determine whether more records remain.\n  * Test audit log searches and automation during the rollout window from **mid-May through late May 2026**.\n  * If you run **Search-UnifiedAuditLog** manually in _PowerShell_ and review results interactively, no changes are needed. You will benefit from improved real-time progress visibility.\n\n\n\n**Learn more:**\n\n  * Learn about auditing solutions in Microsoft Purview | Microsoft Purview | Microsoft Learn\n  * Search-UnifiedAuditLog | policy-and-compliance-audit | ExchangePowerShell | Microsoft Learn\n\n\n\n_If you have questions or need assistance, contact Microsoft Support._\n\n**[Compliance considerations]**\n\n**Question**| **Answer**\n---|---\nDoes the change alter how existing customer data is processed, stored, or accessed?| Yes. The change modifies how audit search results are reported during execution by providing incremental counts instead of a final total upfront.\nDoes the change alter how admins can monitor, report on, or demonstrate compliance activities?| Yes. Administrators gain improved visibility into audit search progress through real-time result reporting, which can enhance monitoring workflows.",
  "title": "MC1310672: Microsoft Purview: Update to ResultCount parameter in the Search-UnifiedAuditLog cmdlet",
  "updatedAt": "2026-05-15T00:00:12.399Z"
}