Write M365 Audit logs using PowerShell

 

This is a PowerShell script to automate downloading of M365 audit logs to a directory. For example, I process these using Power BI. Change the highlighted sections to fit your needs.

Install-Module AzureAD

Install-Module MSOnline

Import-Module ExchangeOnlineManagement

$username = "----login user name---@contoso.com"

$password = ConvertTo-SecureString "---password----” -AsPlainText -Force

$psCred = New-Object System.Management.Automation.PSCredential -ArgumentList ($username, $password)

Connect-MsolService -credential $psCred

Connect-ExchangeOnline -credential $psCred

$dateEnd = Get-Date -Format "MM/dd/yyyy"

$dateStart = (([datetime]$dateEnd).AddDays(-1)).ToString("MM/dd/yyyy")

$dateFile = ($dateStart + "-" + $dateEnd).Replace("/",".")

$path = "c:\location_to_store_audit_logs"

$auditlog = Search-UnifiedAuditLog -StartDate $dateStart -EndDate $dateEnd -SessionCommand ReturnLargeSet -ResultSize 5000

$auditlog | Select-Object -Property CreationDate,UserIds,Operations,AuditData | Export-Csv -Append -Path "$path\O365AuditLog$dateFile.csv" -NoTypeInformation

Sources

• Use a PowerShell script to search the audit log - Microsoft Purview (compliance) | Microsoft Learn
• Office 365 Management Activity API schema | Microsoft Learn
• Search-UnifiedAuditLog (ExchangePowerShell) | Microsoft Learn

Share on Google Plus

About Tom DeMeulenaere

Highly accomplished information technology professional with extensive knowledge in System Center Configuration Manager, Windows Server, SharePoint, and Office 365.