The advent of the MoreRecordsAvailable property gives the Search-UnifiedAuditLog cmdlet more precise control over fetching large numbers of audit records (up to 50,000 records). It’s a welcome change to report something positive about the Microsoft Purview Audit solution because most of the time we complain about its stability, slowness, and bugs. Things are looking up.
A reader asked if it’s possible to discover who made retention label assignments for SharePoint files. The Files Graph API can’t tell you who (or what policy) made retention label assignments, but it’s possible to find this information in the audit log and use that data to report the requested information. All with a few lines of PowerShell!
A new preview feature supports high completeness audit log searches. These searches are optimized to make sure that they find every matching audit instead of finishing as quickly as possible. High completeness audit log searches do take more time but their results are accurate and they find more records than Search-UnifiedAuditLog was able to in the past. Looks like a good new feature.