Get-MgAuditLogSignIn - example usage of InputObject #3312
trahman-hm
started this conversation in
General
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
I'm trying to generate large extracts of user sign-in logs from our EntraID tenant, using the powershell Get-MgAuditLogSignIn tool. There seem to be some limitations in the ability to generate large extracts (hundreds of thousands, if not millions of rows) of sign in logs.
I was thinking of using the INPUTOBJECT option for the command to programmatically break up a query (say for the past 30 days of all my users) into single-day blocks and then submit those single-day blocks in for extraction, then aggregate the results into a single CSV file.
Unfortunately, when I try to use INPUTOBJECT, it seems hung up on the identification of a "SignInId" as part of the included parameters. If I try this:
Import-Module Microsoft.Graph.Reports
Connect-MgGraph -Scopes "AuditLog.Read.All"
$start_date = Get-Date
$end_date = $start_date.AddDays(+1)
$params = @{
StartDateTime = $start_date
EndDateTime = $end_date
}
Get-MgAuditLogSignIn -InputObject $params
I get the following error:
Get-MgAuditLogSignIn_GetViaIdentity: The pipeline has been stopped.
Get-MgAuditLogSignIn_GetViaIdentity: InputObject has null value for InputObject.SignInId
I'm not sure what "SignInId" is a reference to - I tried to include a reference to my own Id, but that seems to fail:
Import-Module Microsoft.Graph.Reports
Connect-MgGraph -Scopes "AuditLog.Read.All"
$context = Get-MgContext
$currentUser = (Get-MgUser -UserId $context.Account).Id
$start_date = Get-Date
$end_date = $start_date.AddDays(+1)
$params = @{
SignInId = $currentUser
StartDateTime = $start_date
EndDateTime = $end_date
}
Get-MgAuditLogSignIn -InputObject $params
I get the following error:
Get-MgAuditLogSignIn_GetViaIdentity: No record found for key: ##myID## (where it dieplays my ID)
Any suggestions as to how to get this working? Even any examples on a working INPUTOBJECT hash table for the command would help.
Beta Was this translation helpful? Give feedback.
All reactions