Investigate the Microsoft 365 audit log past the 50,000-record cap
Microsoft's audit search returns at most 5,000 records per call and 50,000 per session, and an export that hit the cap looks exactly like a complete one. The detail sits in a JSON blob inside the CSV, the search itself returns duplicates, and overlapping exports — the usual workaround — repeat whole windows of records.
How KIROSEC answers it
A free, read-only export script
Our PowerShell script walks the date range in windows, halves any window that hits the cap, writes every field of every record, and records which periods are incomplete. It stores no credential and writes nothing to the tenant.
Download Export-M365UnifiedAudit.ps1Incomplete exports are flagged
An export that stops exactly on one of Microsoft's limits (5,000, 50,000 or 100,000 records) is flagged on import, from any tool. Import it with our script's collection manifest and KIROSEC also warns about every window that came back short — so 'nothing happened' can be told apart from 'we were not shown'.
One record, one event
The AuditData blob is decoded into fields, and records repeated within an export or across overlapping exports are kept once, with the number skipped reported.
Business email compromise detections
Inbox forwarding and hiding rules, mailbox delegation, MailItemsAccessed bursts, OAuth consent grants, MFA changes, password spray and more, mapped to MITRE ATT&CK — alongside Entra sign-ins and message trace in the same case.
Where it stops
- KIROSEC imports exports; it does not connect to your tenant. That is deliberate — no tenant credentials are held — but it means the export step is yours.
- What the audit log contains depends on your Microsoft licence and retention; KIROSEC cannot recover events Microsoft did not keep.
Detections that apply
- Microsoft 365 inbox forwarding rule
- Microsoft 365 mailbox hiding rule
- Microsoft 365 mailbox access burst
- Microsoft 365 OAuth consent grant
- Microsoft 365 MFA fatigue
- Entra password spray
Questions
- How do I export more than 50,000 Unified Audit Log records?
- Split the search into time windows small enough that each stays under the cap. The free Export-M365UnifiedAudit.ps1 script does this automatically, halving any window that hits the cap, and records any window that still could not be fully retrieved.
- Why does my audit log export contain duplicate records?
- Microsoft's audit search can return the same record more than once, and overlapping exports repeat records. KIROSEC keeps each record once, keyed on its record Id, and reports how many duplicates it skipped.
- Can I investigate business email compromise offline?
- Yes. Export the audit log, then import it into KIROSEC on any machine — including one with no network access — and the BEC detections run locally.
Related problems
See it on your own logs
Bring an incident your current tools struggle with. We will show you how KIROSEC handles it, on your machine, with nothing leaving it.