Get-MgBetaAuditLogDirectoryAudit

Module:: Microsoft.Graph.Beta.Reports Module

Get a specific Microsoft Entra audit log item. This includes an audit log item generated by various services within Microsoft Entra ID like user, application, device and group management, privileged identity management (PIM), access reviews, terms of use, identity protection, password management (self-service and admin password resets), self-service group management, and so on.

Note

To view the v1.0 release of this cmdlet, view Get-MgAuditLogDirectoryAudit

Syntax

List (Default)

Get-MgBetaAuditLogDirectoryAudit
    [-ExpandProperty <string[]>]
    [-Property <string[]>]
    [-Filter <string>]
    [-Search <string>]
    [-Skip <int>]
    [-Sort <string[]>]
    [-Top <int>]
    [-ResponseHeadersVariable <string>]
    [-Break]
    [-Headers <IDictionary>]
    [-HttpPipelineAppend <SendAsyncStep[]>]
    [-HttpPipelinePrepend <SendAsyncStep[]>]
    [-Proxy <uri>]
    [-ProxyCredential <pscredential>]
    [-ProxyUseDefaultCredentials]
    [-PageSize <int>]
    [-All]
    [-CountVariable <string>]
    [<CommonParameters>]

Get

Get-MgBetaAuditLogDirectoryAudit
    -DirectoryAuditId <string>
    [-ExpandProperty <string[]>]
    [-Property <string[]>]
    [-ResponseHeadersVariable <string>]
    [-Break]
    [-Headers <IDictionary>]
    [-HttpPipelineAppend <SendAsyncStep[]>]
    [-HttpPipelinePrepend <SendAsyncStep[]>]
    [-Proxy <uri>]
    [-ProxyCredential <pscredential>]
    [-ProxyUseDefaultCredentials]
    [<CommonParameters>]

GetViaIdentity

Get-MgBetaAuditLogDirectoryAudit
    -InputObject <IReportsIdentity>
    [-ExpandProperty <string[]>]
    [-Property <string[]>]
    [-ResponseHeadersVariable <string>]
    [-Break]
    [-Headers <IDictionary>]
    [-HttpPipelineAppend <SendAsyncStep[]>]
    [-HttpPipelinePrepend <SendAsyncStep[]>]
    [-Proxy <uri>]
    [-ProxyCredential <pscredential>]
    [-ProxyUseDefaultCredentials]
    [<CommonParameters>]

Description

Permissions

Permission type	Permissions (from least to most privileged)
Delegated (work or school account)	AuditLog.Read.All, Directory.Read.All,
Delegated (personal Microsoft account)	Not supported
Application	AuditLog.Read.All, Directory.Read.All,

Examples

Example 1: Retrieve the list of audit logs


Import-Module Microsoft.Graph.Beta.Reports

Get-MgBetaAuditLogDirectoryAudit

This example will retrieve the list of audit logs

Example 2: Retrieve the list of audit logs with a filter on initiatedBy/user


Import-Module Microsoft.Graph.Beta.Reports

Get-MgBetaAuditLogDirectoryAudit -Filter "initiatedBy/user/id eq '00000000-0000-0000-0000-000000000000'"

This example will retrieve the list of audit logs with a filter on initiatedby/user

Parameters

-All

List all pages.

Parameter properties

Type:	System.Management.Automation.SwitchParameter
Default value:	False
Supports wildcards:	False
DontShow:	False

Parameter sets

List

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-Break

Wait for .NET debugger to attach

Parameter properties

Type:	System.Management.Automation.SwitchParameter
Default value:	False
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-CountVariable

Specifies a count of the total number of items in a collection. By default, this variable will be set in the global scope.

Parameter properties

Type:	System.String
Supports wildcards:	False
DontShow:	False
Aliases:	CV

Parameter sets

List

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-DirectoryAuditId

The unique identifier of directoryAudit

Parameter properties

Type:	System.String
Supports wildcards:	False
DontShow:	False

Parameter sets

Get

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-ExpandProperty

Expand related entities

Parameter properties

Type:	System.String[]
Supports wildcards:	False
DontShow:	False
Aliases:	Expand

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-Filter

Filter items by property values

Parameter properties

Type:	System.String
Supports wildcards:	False
DontShow:	False

Parameter sets

List

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-Headers

Optional headers that will be added to the request.

Parameter properties

Type:	System.Collections.IDictionary
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	True
Value from pipeline by property name:	False
Value from remaining arguments:	False

-HttpPipelineAppend

SendAsync Pipeline Steps to be appended to the front of the pipeline

Parameter properties

Type:	Microsoft.Graph.Beta.PowerShell.Runtime.SendAsyncStep[]
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-HttpPipelinePrepend

SendAsync Pipeline Steps to be prepended to the front of the pipeline

Parameter properties

Type:	Microsoft.Graph.Beta.PowerShell.Runtime.SendAsyncStep[]
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-InputObject

Identity Parameter To construct, see NOTES section for INPUTOBJECT properties and create a hash table.

Parameter properties

Type:	Microsoft.Graph.Beta.PowerShell.Models.IReportsIdentity
Supports wildcards:	False
DontShow:	False

Parameter sets

GetViaIdentity

Position:	Named
Mandatory:	True
Value from pipeline:	True
Value from pipeline by property name:	False
Value from remaining arguments:	False

-PageSize

Sets the page size of results.

Parameter properties

Type:	System.Int32
Default value:	0
Supports wildcards:	False
DontShow:	False

Parameter sets

List

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-Property

Select properties to be returned

Parameter properties

Type:	System.String[]
Supports wildcards:	False
DontShow:	False
Aliases:	Select

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-Proxy

The URI for the proxy server to use

Parameter properties

Type:	System.Uri
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-ProxyCredential

Credentials for a proxy server to use for the remote call

Parameter properties

Type:	System.Management.Automation.PSCredential
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-ProxyUseDefaultCredentials

Use the default credentials for the proxy

Parameter properties

Type:	System.Management.Automation.SwitchParameter
Default value:	False
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-ResponseHeadersVariable

Optional Response Headers Variable.

Parameter properties

Type:	System.String
Supports wildcards:	False
DontShow:	False
Aliases:	RHV

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-Search

Search items by search phrases

Parameter properties

Type:	System.String
Supports wildcards:	False
DontShow:	False

Parameter sets

List

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-Skip

Skip the first n items

Parameter properties

Type:	System.Int32
Default value:	0
Supports wildcards:	False
DontShow:	False

Parameter sets

List

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-Sort

Order items by property values

Parameter properties

Type:	System.String[]
Supports wildcards:	False
DontShow:	False
Aliases:	OrderBy

Parameter sets

List

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-Top

Show only the first n items

Parameter properties

Type:	System.Int32
Default value:	0
Supports wildcards:	False
DontShow:	False
Aliases:	Limit

Parameter sets

List

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

Inputs

Microsoft.Graph.Beta.PowerShell.Models.IReportsIdentity

System.Collections.IDictionary

Outputs

Microsoft.Graph.Beta.PowerShell.Models.IMicrosoftGraphDirectoryAudit

Notes

COMPLEX PARAMETER PROPERTIES

To create the parameters described below, construct a hash table containing the appropriate properties. For information on hash tables, run Get-Help about_Hash_Tables.

INPUTOBJECT <IReportsIdentity>: Identity Parameter [ActiveUsersMetricId <String>]: The unique identifier of activeUsersMetric [AlertConfigurationId <String>]: The unique identifier of alertConfiguration [AlertId <String>]: The unique identifier of alert [AppCredentialSignInActivityId <String>]: The unique identifier of appCredentialSignInActivity [ApplicationSignInDetailedSummaryId <String>]: The unique identifier of applicationSignInDetailedSummary [AuthenticationsMetricId <String>]: The unique identifier of authenticationsMetric [CredentialUserRegistrationDetailsId <String>]: The unique identifier of credentialUserRegistrationDetails [CustomSecurityAttributeAuditId <String>]: The unique identifier of customSecurityAttributeAudit [DailyInactiveUsersByApplicationMetricId <String>]: The unique identifier of dailyInactiveUsersByApplicationMetric [DailyInactiveUsersMetricId <String>]: The unique identifier of dailyInactiveUsersMetric [Date <DateTime?>]: Usage: date={date} [DeviceManagementCachedReportConfigurationId <String>]: The unique identifier of deviceManagementCachedReportConfiguration [DeviceManagementExportJobId <String>]: The unique identifier of deviceManagementExportJob [DirectoryAuditId <String>]: The unique identifier of directoryAudit [EndDateTime <DateTime?>]: Usage: endDateTime={endDateTime} [ExclusiveIntervalEndDateTime <DateTime?>]: Usage: exclusiveIntervalEndDateTime={exclusiveIntervalEndDateTime} [Filter <String>]: Usage: filter='{filter}' [GroupId <String>]: Usage: groupId='{groupId}' [IncludedUserRoles <String>]: Usage: includedUserRoles='{includedUserRoles}' [IncludedUserTypes <String>]: Usage: includedUserTypes='{includedUserTypes}' [InclusiveIntervalStartDateTime <DateTime?>]: Usage: inclusiveIntervalStartDateTime={inclusiveIntervalStartDateTime} [InsightSummaryId <String>]: The unique identifier of insightSummary [ManifestId <String>]: The unique identifier of manifest [MfaCompletionMetricId <String>]: The unique identifier of mfaCompletionMetric [MfaTelecomFraudMetricId <String>]: The unique identifier of mfaTelecomFraudMetric [MfaUserCountMetricId <String>]: The unique identifier of mfaUserCountMetric [MonthlyInactiveUsersByApplicationMetricId <String>]: The unique identifier of monthlyInactiveUsersByApplicationMetric [MonthlyInactiveUsersMetricId <String>]: The unique identifier of monthlyInactiveUsersMetric [OperationId <String>]: The unique identifier of operation [Period <String>]: Usage: period='{period}' [PrintUsageByPrinterId <String>]: The unique identifier of printUsageByPrinter [PrintUsageByUserId <String>]: The unique identifier of printUsageByUser [PrintUsageId <String>]: The unique identifier of printUsage [PrinterId <String>]: Usage: printerId='{printerId}' [ProvisioningObjectSummaryId <String>]: The unique identifier of provisioningObjectSummary [SelfServiceSignUpId <String>]: The unique identifier of selfServiceSignUp [ServicePrincipalSignInActivityId <String>]: The unique identifier of servicePrincipalSignInActivity [SignInId <String>]: The unique identifier of signIn [Skip <Int32?>]: Usage: skip={skip} [SkipToken <String>]: Usage: skipToken='{skipToken}' [StartDateTime <DateTime?>]: Usage: startDateTime={startDateTime} [Top <Int32?>]: Usage: top={top} [UserCountMetricId <String>]: The unique identifier of userCountMetric [UserCredentialUsageDetailsId <String>]: The unique identifier of userCredentialUsageDetails [UserEventsSummaryId <String>]: The unique identifier of userEventsSummary [UserId <String>]: Usage: userId='{userId}' [UserMfaSignInSummaryId <String>]: The unique identifier of userMfaSignInSummary [UserPasswordResetsAndChangesSummaryId <String>]: The unique identifier of userPasswordResetsAndChangesSummary [UserRegistrationDetailsId <String>]: The unique identifier of userRegistrationDetails [UserRequestsMetricId <String>]: The unique identifier of userRequestsMetric [UserSignUpMetricId <String>]: The unique identifier of userSignUpMetric

Share via

Get-MgBetaAuditLogDirectoryAudit

Syntax

List (Default)

Get

GetViaIdentity

Description

Examples

Example 1: Retrieve the list of audit logs

Example 2: Retrieve the list of audit logs with a filter on initiatedBy/user

Parameters

-All

Parameter properties

Parameter sets

-Break

Parameter properties

Parameter sets

-CountVariable

Parameter properties

Parameter sets

-DirectoryAuditId

Parameter properties

Parameter sets

-ExpandProperty

Parameter properties

Parameter sets

-Filter

Parameter properties

Parameter sets

-Headers

Parameter properties

Parameter sets

-HttpPipelineAppend

Parameter properties

Parameter sets

-HttpPipelinePrepend

Parameter properties

Parameter sets

-InputObject

Parameter properties

Parameter sets

-PageSize

Parameter properties

Parameter sets

-Property

Parameter properties

Parameter sets

-Proxy

Parameter properties

Parameter sets

-ProxyCredential

Parameter properties

Parameter sets

-ProxyUseDefaultCredentials

Parameter properties

Parameter sets

-ResponseHeadersVariable

Parameter properties

Parameter sets

-Search

Parameter properties

Parameter sets

-Skip

Parameter properties

Parameter sets

-Sort

Parameter properties

Parameter sets

-Top

Parameter properties

Parameter sets

CommonParameters

Inputs

Microsoft.Graph.Beta.PowerShell.Models.IReportsIdentity

System.Collections.IDictionary

Outputs

Microsoft.Graph.Beta.PowerShell.Models.IMicrosoftGraphDirectoryAudit

Notes

Related Links