JyskIT.Automation

2.1.10

LogSearch.ps1

#$log | Where-Object UserIds -ne 'jyskit-adm@maanssons.onmicrosoft.com' | Sort-Object UserIds | Select-Object UserIds -Unique
$results = @()
$log2 = $log | Where-Object {$_.UserIds -in 'sub@maanssons.dk'}

$log2 | ForEach-Object {
    $obj = $_
    $when = $obj.CreationDate
    $who = $obj.UserIds
    $operation = $obj.Operations
    $auditData = $obj.AuditData | ConvertFrom-Json

    $results += [PSCustomObject]@{
        Timestamp = $when
        User = $who
        Operation = $operation
        ClientAppName = $auditData.AppAccessContext.ClientAppName
        Object = $auditData.ObjectId
    }

}