Searching Unified Audit Logs via PowerShell - WARNING: Failed to process request via SyncSearch flag, returning HttpRequestException. Exception: NotFound , Reason: Not Found.

Question

A few days ago, I began experiencing an issue where I can no longer search the Unified Audit Logs via PowerShell in certain tenants. The exact same command works without issue in some tenants, but fails in others.

Here’s the command I’m using:

Search-UnifiedAuditLog `
  -StartDate '6/10/2025' `
  -EndDate '6/15/2025' `
  -Operations "New-InboxRule"

In some environments, this runs successfully. However, in others, I receive the following warning:

WARNING: Failed to process request via SyncSearch flag, returning HttpRequestException. Exception: NotFound , Reason: Not Found.

I currently have a support ticket open with Microsoft, but the issue remains unresolved.

I also came across a similar question posted here: https://learn.microsoft.com/en-us/answers/questions/2285174/error-when-retrieving-powerbi-audit-data-via-searc It seems the original poster found a resolution, but their solution hasn’t worked in my case.

I’ve tested various combinations of start and end dates as suggested in the post, but none have resolved the issue.

Update 1 - 6/23/2025:

This appears to be working now. No modifications to my scripts were performed - just running them again.

I still have not been able to find any acknowledgement from Microsoft in the Health section in the admin center for this

Update 2 - 6/23/2025:

I spoke with MS support who was assisting who explained that there was an issue on the backend with caching that had to be manually resolved by them. If anyone else runs into this issue, MS support needs to do something on their end to resolve it.

Answer 1

@Karl Hudnut

Yes, I agree with you the start and end date likely isn't related. I tested with the latest PowerShell and ExchangeOnlineManagement module, testing this in a sandbox VM that had a new version of Windows.

With the exact command working in some tenants but not working in other tenants leads me to believe that there is some issue on the backend with this.

This issue appears to also be linked specifically to the ExchangeOnlineManagement module with how uses the API. I have code that can natively interact with the API using an App Registration without using the module and I have working code in the tenants where it isn't working in using the module.

Hopefully, more visibility to this issue will get this resolved quicker.

Answer 2

Hi @Chaim Black  , 

Thank you for posting your question in the Microsoft Q&A forum.   

Based on your inquiry, we understand that you have considered an error  announcement while command Unified Audit Logs via PowerShell. We will be glad to assist you in this part.     

Could you please provide more information to troubleshoot it better: 

1. Could you provide the PowerShell and ExchangeOnlineManagement module version which you using to run this command? If it possible, could you update it to the latest version for PowerShell (7.5.1) and ExchangeOnlineManagement module (3.8.0) then check the result again. 
2. Have you tried it on Windows PowerShell yet? I've encountered some errors related to the Exchange module when running cmdlets in PowerShell ISE, which could cause it not to work well in some scenarios.

If you need further assistance, please let us know.   

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".       

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.     

Answer 3

Good morning, we are facing the same issue, the same script deployed in different clients using the cmdlet Search-UnifiedAuditLog from yesterday works in some clients but not for others.

Our script connects to ExchangeOnline via Application and Digital Certificate. So, in order to try to fix the problem, from a single computer (in this case using Powershell 5.1 and ExchangeOnline 3.7.2) we have connectd to one client where it works, after that we have made the same to another client where it doesn't work to discard problems of versions. After that, in the client where it doesn't work using App/Certificate, we have connected manually to ExchangeOnline and again the Search-UnifiedAuditLog doesn't work.

Really it seems a backend problem but will continue working to try to find a solution.

Answer 4

@Hin-V I tried it on multiple devices with multiple versions of PowerShell and ExchangeOnlineManagement. This issue is linked to specific tenants where it works fine on some but not others.

Here is a couple of setups I tried:

1. PowerShell 7.5.1 \ ExchangeOnlineManagement 2.0.5
2. PowerShell 5.1 \ ExchangeOnlineManagement 2.0.5
3. PowerShell 7.5.1 \ ExchangeOnlineManagement 3.6.0
4. PowerShell 5.1 \ ExchangeOnlineManagement 3.6.0
5. PowerShell 7.5.1 \ ExchangeOnlineManagement 3.8.0
6. PowerShell 5.1 \ ExchangeOnlineManagement 3.8.0
7. PowerShell 7.4.6 \ ExchangeOnlineManagement 3.6.0

Answer 5

Update 6/23/2025:

This appears to be working now. No modifications to my scripts were performed - just running them again.

I still have not been able to find any acknowledgement from Microsoft in the Health section in the admin center for this