Microsoft Purview audit-log search via PowerShell is performed with Exchange Online cmdlets. Microsoft's guidance states: "Use the Search-UnifiedAuditLog cmdlet to search the audit log for events." This cmdlet is part of the Exchange Online PowerShell (ExchangeOnlineManagement) module and requires you to connect to the service before running queries. Microsoft further notes that you must install and import the Exchange Online PowerShell V2 module and then connect (for example, Connect-ExchangeOnline) to run compliance and audit-related cmdlets, including Search-UnifiedAuditLog. In short, on a Windows device the first prerequisite is installing the Exchange Online PowerShell module, after which you authenticate and run your audit searches. Alternatives such as enabling remoting or modifying TrustedHosts are unrelated, and the Microsoft Graph PowerShell module does not provide the Search-UnifiedAuditLog cmdlet that Purview audit searches rely on. Therefore, the correct first step is to install the Microsoft Exchange Online PowerShell module.