Write M365 Audit logs using PowerShell


This is a PowerShell script to automate downloading of M365 audit logs to a directory. For example, I process these using Power BI. Change the highlighted sections to fit your needs.

Install-Module AzureAD

Install-Module MSOnline

Import-Module ExchangeOnlineManagement

$username = "----login user name---@contoso.com"

$password = ConvertTo-SecureString "---password----” -AsPlainText -Force

$psCred = New-Object System.Management.Automation.PSCredential -ArgumentList ($username, $password)

Connect-MsolService -credential $psCred

Connect-ExchangeOnline -credential $psCred

$dateEnd = Get-Date -Format "MM/dd/yyyy"

$dateStart = (([datetime]$dateEnd).AddDays(-1)).ToString("MM/dd/yyyy")

$dateFile = ($dateStart + "-" + $dateEnd).Replace("/",".")

$path = "c:\location_to_store_audit_logs"

$auditlog = Search-UnifiedAuditLog -StartDate $dateStart -EndDate $dateEnd -SessionCommand ReturnLargeSet -ResultSize 5000

$auditlog | Select-Object -Property CreationDate,UserIds,Operations,AuditData | Export-Csv -Append -Path "$path\O365AuditLog$dateFile.csv" -NoTypeInformation


Share on Google Plus

About Tom DeMeulenaere

Highly accomplished information technology professional with extensive knowledge in System Center Configuration Manager, Windows Server, SharePoint, and Office 365.
    Blogger Comment


Post a Comment

Note: Only a member of this blog may post a comment.