Converting Scripts from Search-UnifiedAuditLog
Investigating the work necessary to convert PowerShell scripts based on the Search-UnifiedAuditLog cmdlet to use the AuditLogQuery Graph API shows that it’s not easy. Running audit jobs is a multi-stage process rather than running a simple cmdlet. Parameter values are now passed in a request body, and the properties output in the AuditData payload use a different format. This is definitely not a drop-in exercise, so it’s time to find scripts that need conversion.