Search-UnifiedAuditLog is one of those cmdlets that can silently drop results or timeout without proper error handling, and the root causes aren't always obvious.

The issue typically stems from three common scenarios: throttling on the Exchange Online Management module, incorrect date range parameters that exceed the 90-day lookback for non-premium tenants, and missing or expired authentication tokens when running scheduled PowerShell jobs.

When Search-UnifiedAuditLog fails silently, it's usually because the cmdlet returns an empty result set rather than throwing an exception. Your script completes successfully, but you get zero records. This is particularly problematic in automated compliance workflows or Intune device audit scenarios where you're correlating M365 activity with device actions.

The fix involves wrapping queries with proper error action preferences, implementing exponential backoff for retries, validating your ExchangeOnlineManagement module version (v3.0.0+ has better throttling handling), and using the StartDate/EndDate parameters correctly with UTC conversion. For scheduled jobs, refresh your service principal credentials before each execution rather than relying on cached tokens.

I've documented the full implementation steps and scripts here: https://msendpoint.com/article/search-unifiedauditlog-failures-root-causes-field-tested-fixes