Write M365 Audit logs using PowerShell

 

This is a PowerShell script to automate downloading of M365 audit logs to a directory. For example, I process these using Power BI. Change the highlighted sections to fit your needs.


Install-Module AzureAD

Install-Module MSOnline

Import-Module ExchangeOnlineManagement


$username = "----login user name---@contoso.com"

$password = ConvertTo-SecureString "---password----” -AsPlainText -Force

$psCred = New-Object System.Management.Automation.PSCredential -ArgumentList ($username, $password)


Connect-MsolService -credential $psCred

Connect-ExchangeOnline -credential $psCred


$dateEnd = Get-Date -Format "MM/dd/yyyy"

$dateStart = (([datetime]$dateEnd).AddDays(-1)).ToString("MM/dd/yyyy")

$dateFile = ($dateStart + "-" + $dateEnd).Replace("/",".")

$path = "c:\location_to_store_audit_logs"


$auditlog = Search-UnifiedAuditLog -StartDate $dateStart -EndDate $dateEnd -ResultSize 5000

$auditlog | Select-Object -Property CreationDate,UserIds,Operations,AuditData | Export-Csv -Append -Path "$path\O365AuditLog$dateFile.csv" -NoTypeInformation

Share on Google Plus

About Tom DeMeulenaere

Highly accomplished information technology professional with extensive knowledge in System Center Configuration Manager, Windows Server, SharePoint, and Office 365.
    Blogger Comment

0 comments:

Post a Comment

Note: Only a member of this blog may post a comment.