Microsoft.Entra.Beta.Reports-Help.xml
|
<?xml version="1.0" encoding="utf-8"?>
<helpItems schema="maml" xmlns="http://msh"> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Get-EntraBetaApplicationSignInDetailedSummary</command:name> <command:verb>Get</command:verb> <command:noun>EntraBetaApplicationSignInDetailedSummary</command:noun> <maml:description> <maml:para>Get detailed sign in summaries.</maml:para> </maml:description> </command:details> <maml:description> <maml:para>The `Get-EntraBetaApplicationSignInDetailedSummary` cmdlet gets Microsoft Entra ID sign ins, grouped by application, date, and sign in status.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Get-EntraBetaApplicationSignInDetailedSummary</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="named" aliases="none"> <maml:name>Top</maml:name> <maml:description> <maml:para>The maximum number of records to return.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">Sysetm.Int32</command:parameterValue> <dev:type> <maml:name>Sysetm.Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="named" aliases="none"> <maml:name>Filter</maml:name> <maml:description> <maml:para>The OData v4.0 filter statement. Controls which objects are returned.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">System.String</command:parameterValue> <dev:type> <maml:name>System.String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="named" aliases="none"> <maml:name>Top</maml:name> <maml:description> <maml:para>The maximum number of records to return.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">Sysetm.Int32</command:parameterValue> <dev:type> <maml:name>Sysetm.Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="named" aliases="none"> <maml:name>Filter</maml:name> <maml:description> <maml:para>The OData v4.0 filter statement. Controls which objects are returned.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">System.String</command:parameterValue> <dev:type> <maml:name>System.String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes /> <command:returnValues> <command:returnValue> <dev:type> <maml:name>Microsoft.Online.Administration.GetApplicationSignInDetailedSummaryObjectsResponse</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet> <maml:alert> <maml:para></maml:para> </maml:alert> </maml:alertSet> <command:examples> <command:example> <maml:title>----------- Example 1: Get sign in detailed summary -----------</maml:title> <dev:code>Connect-Entra -Scopes 'Reports.Read.All' Get-EntraBetaApplicationSignInDetailedSummary Id AggregatedEventDateTime AppDisplayName AppId SignInCount -- ----------------------- -------------- ----- ----------- aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb 08-07-2024 00:00:00 Graph Explorer 00001111-aaaa-2222-bbbb-3333cccc4444 3 bbbbbbbb-1111-2222-3333-cccccccccccc 04-07-2024 00:00:00 Graph Explorer 11112222-bbbb-3333-cccc-4444dddd55551 cccccccc-2222-3333-4444-dddddddddddd 05-07-2024 00:00:00 Graph Explorer 22223333-cccc-4444-dddd-5555eeee6666 4 dddddddd-3333-4444-5555-eeeeeeeeeeee 19-06-2024 00:00:00 Azure Portal 33334444-dddd-5555-eeee-6666ffff77773 eeeeeeee-4444-5555-6666-ffffffffffff 27-06-2024 00:00:00 Azure Portal 44445555-eeee-6666-ffff-7777aaaa8888 2 ffffffff-5555-6666-7777-aaaaaaaaaaaa 03-07-2024 00:00:00 Azure Portal 55556666-ffff-7777-aaaa-8888bbbb9999 1 aaaaaaaa-6666-7777-8888-bbbbbbbbbbbb 01-07-2024 00:00:00 Azure Portal 66667777-aaaa-8888-bbbb-9999cccc0000 13 bbbbbbbb-7777-8888-9999-cccccccccccc 28-06-2024 00:00:00 Azure Portal 77776666-aaaa-9999-bbbb-0000cccc1111 9</dev:code> <dev:remarks> <maml:para>This example returns all sign ins to Microsoft Entra ID Portal.</maml:para> </dev:remarks> </command:example> <command:example> <maml:title>Example 2: Get sign in detailed summary by application and date</maml:title> <dev:code>Connect-Entra -Scopes 'Reports.Read.All' Get-EntraBetaApplicationSignInDetailedSummary -Filter "appDisplayName eq 'Azure Portal' AND aggregatedEventDateTime gt 2024-10-20 AND aggregatedEventDateTime lt 2024-10-22" Id AggregatedEventDateTime AppDisplayName AppId SignInCount -- ----------------------- -------------- ----- ----------- aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb 27-06-2024 00:00:00 Azure Portal 00001111-aaaa-2222-bbbb-3333cccc4444 2 bbbbbbbb-1111-2222-3333-cccccccccccc 28-06-2024 00:00:00 Azure Portal 11112222-bbbb-3333-cccc-4444dddd5555 9 cccccccc-2222-3333-4444-dddddddddddd 21-06-2024 00:00:00 Azure Portal 22223333-cccc-4444-dddd-5555eeee6666 2 dddddddd-3333-4444-5555-eeeeeeeeeeee 20-06-2024 00:00:00 Azure Portal 33334444-dddd-5555-eeee-6666ffff7777 3 eeeeeeee-4444-5555-6666-ffffffffffff 20-06-2024 00:00:00 Azure Portal 44445555-eeee-6666-ffff-7777aaaa8888 1 ffffffff-5555-6666-7777-aaaaaaaaaaaa 19-06-2024 00:00:00 Azure Portal 55556666-ffff-7777-aaaa-8888bbbb9999 3 aaaaaaaa-6666-7777-8888-bbbbbbbbbbbb 17-06-2024 00:00:00 Azure Portal 66667777-aaaa-8888-bbbb-9999cccc0000 3 bbbbbbbb-7777-8888-9999-cccccccccccc 18-06-2024 00:00:00 Azure Portal 77776666-aaaa-9999-bbbb-0000cccc1111 6</dev:code> <dev:remarks> <maml:para>This example returns all sign ins to Microsoft Entra ID Portal for the month of June.</maml:para> </dev:remarks> </command:example> <command:example> <maml:title>--------------- Example 3: Get top five sign ins ---------------</maml:title> <dev:code>Connect-Entra -Scopes 'Reports.Read.All' Get-EntraBetaApplicationSignInDetailedSummary -Top 5 Id AggregatedEventDateTime AppDisplayName AppId SignInCount -- ----------------------- -------------- ----- ----------- aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb 27-06-2024 00:00:00 Azure Portal 00001111-aaaa-2222-bbbb-3333cccc4444 2 bbbbbbbb-1111-2222-3333-cccccccccccc 28-06-2024 00:00:00 Azure Portal 11112222-bbbb-3333-cccc-4444dddd5555 9 cccccccc-2222-3333-4444-dddddddddddd 21-06-2024 00:00:00 Azure Portal 22223333-cccc-4444-dddd-5555eeee6666 2 dddddddd-3333-4444-5555-eeeeeeeeeeee 20-06-2024 00:00:00 Azure Portal 33334444-dddd-5555-eeee-6666ffff7777 3 eeeeeeee-4444-5555-6666-ffffffffffff 20-06-2024 00:00:00 Azure Portal 44445555-eeee-6666-ffff-7777aaaa8888 1</dev:code> <dev:remarks> <maml:para>This example returns top five sign ins to Microsoft Entra ID portal.</maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version:</maml:linkText> <maml:uri>https://learn.microsoft.com/powershell/module/Microsoft.Entra.Beta/Get-EntraBetaApplicationSignInDetailedSummary</maml:uri> </maml:navigationLink> </command:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Get-EntraBetaApplicationSignInSummary</command:name> <command:verb>Get</command:verb> <command:noun>EntraBetaApplicationSignInSummary</command:noun> <maml:description> <maml:para>Get sign in summary by last number of days.</maml:para> </maml:description> </command:details> <maml:description> <maml:para>The `Get-EntraBetaApplicationSignInSummary` cmdlet gets sign-in summaries for the last 7 or 30 days.</maml:para> <maml:para>Returns the properties below:</maml:para> <maml:para>- appDisplayName - the name of the application that the user signed into.</maml:para> <maml:para>- failedSignInCount - count of failed sign-ins made by the application.</maml:para> <maml:para>- successPercentage - the percentage of successful sign-ins made by the application.</maml:para> <maml:para>- successfulSignInCount - count of successful sign-ins made by the application.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Get-EntraBetaApplicationSignInSummary</maml:name> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="named" aliases="none"> <maml:name>Days</maml:name> <maml:description> <maml:para>Number of past days summary contains. Valid values are 7 and 30</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">System.Int32</command:parameterValue> <dev:type> <maml:name>System.Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="named" aliases="none"> <maml:name>Filter</maml:name> <maml:description> <maml:para>The OData v4.0 filter statement. Controls which objects are returned.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">System.String</command:parameterValue> <dev:type> <maml:name>System.String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="named" aliases="none"> <maml:name>Top</maml:name> <maml:description> <maml:para>The maximum number of records to return.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">System.Int32</command:parameterValue> <dev:type> <maml:name>System.Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="named" aliases="none"> <maml:name>Days</maml:name> <maml:description> <maml:para>Number of past days summary contains. Valid values are 7 and 30</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">System.Int32</command:parameterValue> <dev:type> <maml:name>System.Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="named" aliases="none"> <maml:name>Filter</maml:name> <maml:description> <maml:para>The OData v4.0 filter statement. Controls which objects are returned.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">System.String</command:parameterValue> <dev:type> <maml:name>System.String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="named" aliases="none"> <maml:name>Top</maml:name> <maml:description> <maml:para>The maximum number of records to return.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">System.Int32</command:parameterValue> <dev:type> <maml:name>System.Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes /> <command:returnValues> <command:returnValue> <dev:type> <maml:name>Microsoft.Online.Administration.GetApplicationSignInSummaryObjectsResponse</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet> <maml:alert> <maml:para></maml:para> </maml:alert> </maml:alertSet> <command:examples> <command:example> <maml:title>Example 1: Get sign in summary by application for the last week</maml:title> <dev:code>Connect-Entra -Scopes 'Reports.Read.All' Get-EntraBetaApplicationSignInSummary -Days 7 -Filter "appDisplayName eq 'Graph Explorer'" Id AppDisplayName FailedSignInCount SuccessPercentage SuccessfulSignInCount -- -------------- ----------------- ----------------- --------------------- aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb Graph Explorer 0 100 14</dev:code> <dev:remarks> <maml:para>This example returns a summary of all sign ins to Graph Explorer for the last seven days.</maml:para> <maml:para>- `-Days` parameter specifies the number of past days summary contains. Valid values are only 7 and 30.</maml:para> </dev:remarks> </command:example> <command:example> <maml:title>----- Example 2: Get sign in summaries for the last month -----</maml:title> <dev:code>Connect-Entra -Scopes 'Reports.Read.All' Get-EntraBetaApplicationSignInSummary -Days 30 Id AppDisplayName FailedSignInCount SuccessPercentage SuccessfulSignInCount -- -------------- ----------------- ----------------- --------------------- aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb Graph Explorer 3 96.74 89 bbbbbbbb-1111-2222-3333-cccccccccccc Azure Portal 3 99.15 350 cccccccc-2222-3333-4444-dddddddddddd Microsoft Community v2 0 100 4</dev:code> <dev:remarks> <maml:para>This example returns summaries for all sign ins from the past 30 days.</maml:para> <maml:para>- `-Days` parameter specifies the number of past days summary contains. Valid values are only 7 and 30.</maml:para> </dev:remarks> </command:example> <command:example> <maml:title>- Example 3: Get top two sign in summaries for the last month -</maml:title> <dev:code>Connect-Entra -Scopes 'Reports.Read.All' Get-EntraBetaApplicationSignInSummary -Days 30 -Top 2 Id AppDisplayName FailedSignInCount SuccessPercentage SuccessfulSignInCount -- -------------- ----------------- ----------------- --------------------- aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb Graph Explorer 3 96.74 89 bbbbbbbb-1111-2222-3333-cccccccccccc Azure Portal 3 99.15 350</dev:code> <dev:remarks> <maml:para>This example returns top two summaries sign ins from the past 30 days.</maml:para> <maml:para>- `-Days` parameter specifies the number of past days summary contains. Valid values are only 7 and 30.</maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version:</maml:linkText> <maml:uri>https://learn.microsoft.com/powershell/module/Microsoft.Entra.Beta/Get-EntraBetaApplicationSignInSummary</maml:uri> </maml:navigationLink> </command:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Get-EntraBetaAuditDirectoryLog</command:name> <command:verb>Get</command:verb> <command:noun>EntraBetaAuditDirectoryLog</command:noun> <maml:description> <maml:para>Get directory audit logs.</maml:para> </maml:description> </command:details> <maml:description> <maml:para>The `Get-EntraBetaAuditDirectoryLog` cmdlet gets a Microsoft Entra ID audit log. Retrieve audit logs from Microsoft Entra ID, covering logs from various services such as user, app, device, and group management, privileged identity management (PIM), access reviews, terms of use, identity protection, password management (SSPR and admin resets), and self-service group management.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Get-EntraBetaAuditDirectoryLog</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>All</maml:name> <maml:description> <maml:para>List all pages.</maml:para> </maml:description> <dev:type> <maml:name>System.Management.Automation.SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="named" aliases="none"> <maml:name>Top</maml:name> <maml:description> <maml:para>The maximum number of records to return.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">System.Int32</command:parameterValue> <dev:type> <maml:name>System.Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="named" aliases="none"> <maml:name>Filter</maml:name> <maml:description> <maml:para>The OData v4.0 filter statement. Controls which objects are returned.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">System.String</command:parameterValue> <dev:type> <maml:name>System.String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Property</maml:name> <maml:description> <maml:para>Specifies properties to be returned</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">System.String[]</command:parameterValue> <dev:type> <maml:name>System.String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>All</maml:name> <maml:description> <maml:para>List all pages.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">System.Management.Automation.SwitchParameter</command:parameterValue> <dev:type> <maml:name>System.Management.Automation.SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="named" aliases="none"> <maml:name>Top</maml:name> <maml:description> <maml:para>The maximum number of records to return.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">System.Int32</command:parameterValue> <dev:type> <maml:name>System.Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="named" aliases="none"> <maml:name>Filter</maml:name> <maml:description> <maml:para>The OData v4.0 filter statement. Controls which objects are returned.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">System.String</command:parameterValue> <dev:type> <maml:name>System.String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Property</maml:name> <maml:description> <maml:para>Specifies properties to be returned</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">System.String[]</command:parameterValue> <dev:type> <maml:name>System.String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes /> <command:returnValues /> <maml:alertSet> <maml:alert> <maml:para>`Get-EntraBetaAuditDirectoryLogs` is an alias for `Get-EntraBetaAuditDirectoryLog`.</maml:para> </maml:alert> </maml:alertSet> <command:examples> <command:example> <maml:title>------------------- Example 1: Get all logs -------------------</maml:title> <dev:code>Connect-Entra -Scopes 'AuditLog.Read.All, Directory.Read.All' Get-EntraBetaAuditDirectoryLog -All Id ActivityDateTime ActivityDisplayName Category CorrelationId -- ---------------- ------------------- -------- ------------- Directory_aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb 17/07/2024 08:55:34 Add service principal ApplicationManagement aaaa0000-bb11-2222-33cc-444444dddddd Directory_bbbbbbbb-1111-2222-3333-cccccccccccc 17/07/2024 07:31:54 Update user UserManagement bbbb1111-cc22-3333-44dd-555555eeeeee SSGM_cccccccc-2222-3333-4444-dddddddddddd 17/07/2024 07:13:08 GroupsODataV4_GetgroupLifecyclePolicies GroupManagement cccc2222-dd33-4444-55ee-666666ffffff</dev:code> <dev:remarks> <maml:para>This command gets all audit logs.</maml:para> </dev:remarks> </command:example> <command:example> <maml:title>----------------- Example 2: Get first n logs -----------------</maml:title> <dev:code>Connect-Entra -Scopes 'AuditLog.Read.All, Directory.Read.All' Get-EntraBetaAuditDirectoryLog -Top 1 Id ActivityDateTime ActivityDisplayName Category CorrelationId LoggedB yServic e -- ---------------- ------------------- -------- ------------- ------- Directory_aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb_8IAPT_617717139 17/07/2024 08:55:34 Add service principal ApplicationManagement aaaa0000-bb11-2222-33cc-444444dddddd Core...</dev:code> <dev:remarks> <maml:para>This example returns the first N logs.</maml:para> </dev:remarks> </command:example> <command:example> <maml:title>Example 3: Get audit logs containing a given ActivityDisplayName</maml:title> <dev:code>Connect-Entra -Scopes 'AuditLog.Read.All, Directory.Read.All' Get-EntraBetaAuditDirectoryLog -Filter "ActivityDisplayName eq 'Update rollout policy of feature'" -Top 1 Id ActivityDateTime ActivityDisplayName Category CorrelationId -- ---------------- ------------------- -------- ------------- Application Proxy_aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb 16/07/2024 05:13:49 Update rollout policy of feature Authentication aaaa0000-bb11-2222-33cc-444444dddddd</dev:code> <dev:remarks> <maml:para>This command shows how to get audit logs by ActivityDisplayName.</maml:para> </dev:remarks> </command:example> <command:example> <maml:title>------ Example 4: Get all audit logs with a given result ------</maml:title> <dev:code>Connect-Entra -Scopes 'AuditLog.Read.All, Directory.Read.All' Get-EntraBetaAuditDirectoryLog -Filter "result eq 'failure'" -All</dev:code> <dev:remarks> <maml:para>This command shows how to get audit logs by the result.</maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version:</maml:linkText> <maml:uri>https://learn.microsoft.com/powershell/module/Microsoft.Entra.Beta/Get-EntraBetaAuditDirectoryLog</maml:uri> </maml:navigationLink> </command:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Get-EntraBetaAuditSignInLog</command:name> <command:verb>Get</command:verb> <command:noun>EntraBetaAuditSignInLog</command:noun> <maml:description> <maml:para>Get audit logs of sign-ins.</maml:para> </maml:description> </command:details> <maml:description> <maml:para>The `Get-EntraBetaAuditSignInLog` cmdlet gets the Microsoft Entra ID sign-in log.</maml:para> <maml:para>In addition to delegated permissions, the signed-in user must belong to at least one of the following Microsoft Entra roles to read sign-in reports:</maml:para> <maml:para>- Global Reader</maml:para> <maml:para>- Reports Reader</maml:para> <maml:para>- Security Administrator</maml:para> <maml:para>- Security Operator</maml:para> <maml:para>- Security Reader</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Get-EntraBetaAuditSignInLog</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>All</maml:name> <maml:description> <maml:para>List all pages.</maml:para> </maml:description> <dev:type> <maml:name>System.Management.Automation.SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="named" aliases="none"> <maml:name>Top</maml:name> <maml:description> <maml:para>The maximum number of records to return.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">System.Int32</command:parameterValue> <dev:type> <maml:name>System.Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="named" aliases="none"> <maml:name>Filter</maml:name> <maml:description> <maml:para>The OData v4.0 filter statement. Controls which objects are returned.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">System.String</command:parameterValue> <dev:type> <maml:name>System.String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Property</maml:name> <maml:description> <maml:para>Specifies properties to be returned</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">System.String[]</command:parameterValue> <dev:type> <maml:name>System.String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>All</maml:name> <maml:description> <maml:para>List all pages.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">System.Management.Automation.SwitchParameter</command:parameterValue> <dev:type> <maml:name>System.Management.Automation.SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="named" aliases="none"> <maml:name>Top</maml:name> <maml:description> <maml:para>The maximum number of records to return.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">System.Int32</command:parameterValue> <dev:type> <maml:name>System.Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName, ByValue)" position="named" aliases="none"> <maml:name>Filter</maml:name> <maml:description> <maml:para>The OData v4.0 filter statement. Controls which objects are returned.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">System.String</command:parameterValue> <dev:type> <maml:name>System.String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>Property</maml:name> <maml:description> <maml:para>Specifies properties to be returned</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">System.String[]</command:parameterValue> <dev:type> <maml:name>System.String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes /> <command:returnValues /> <maml:alertSet> <maml:alert> <maml:para>`Get-EntraBetaAuditSignInLogs` is an alias for `Get-EntraBetaAuditSignInLog`.</maml:para> </maml:alert> </maml:alertSet> <command:examples> <command:example> <maml:title>------------------- Example 1: Get all logs -------------------</maml:title> <dev:code>Connect-Entra -Scopes 'AuditLog.Read.All','Directory.Read.All' Get-EntraBetaAuditSignInLog -All Id AppDisplayName AppId AppTokenProtectionStatus AuthenticationMethodsUsed AuthenticationProtocol -- -------------- ----- ------------------------ ------------------------- ---------------------- aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb Azure Active Directory PowerShell 00001111-aaaa-2222-bbbb-3333cccc4444 {} none bbbbbbbb-1111-2222-3333-cccccccccccc Azure Portal 11112222-bbbb-3333-cccc-4444dddd5555 {} none cccccccc-2222-3333-4444-dddddddddddd Azure Active Directory PowerShell 22223333-cccc-4444-dddd-5555eeee6666 {} none dddddddd-3333-4444-5555-eeeeeeeeeeee Azure Active Directory PowerShell 33334444-dddd-5555-eeee-6666ffff7777 {} none</dev:code> <dev:remarks> <maml:para>This example returns all audit logs of sign-ins.</maml:para> </dev:remarks> </command:example> <command:example> <maml:title>-------------- Example 2: Get the first two logs --------------</maml:title> <dev:code>Connect-Entra -Scopes 'AuditLog.Read.All','Directory.Read.All' Get-EntraBetaAuditSignInLog -Top 2 Id AppDisplayName AppId AppTokenProtectionStatus AuthenticationMethodsUsed AuthenticationProtocol -- -------------- ----- ------------------------ ------------------------- ---------------------- aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb Azure Active Directory PowerShell 00001111-aaaa-2222-bbbb-3333cccc4444 {} none bbbbbbbb-1111-2222-3333-cccccccccccc Azure Portal 11112222-bbbb-3333-cccc-4444dddd5555 {} none</dev:code> <dev:remarks> <maml:para>This example returns the first two audit logs of sign-ins.</maml:para> </dev:remarks> </command:example> <command:example> <maml:title>- Example 3: Get audit logs containing a given AppDisplayName -</maml:title> <dev:code>Connect-Entra -Scopes 'AuditLog.Read.All','Directory.Read.All' Get-EntraBetaAuditSignInLog -Filter "AppDisplayName eq 'Graph Explorer'" -Top 1 Id AppDisplayName AppId AppTokenProtectionStatus AuthenticationMethodsUsed AuthenticationProtocol -- -------------- ----- ------------------------ ------------------------- ---------------------- aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb Graph Explorer PowerShell 00001111-aaaa-2222-bbbb-3333cccc4444</dev:code> <dev:remarks> <maml:para>This example demonstrates how to retrieve sign-in logs by AppDisplayName.</maml:para> </dev:remarks> </command:example> <command:example> <maml:title>-------- Example 4: Get all sign-in logs between dates --------</maml:title> <dev:code>Connect-Entra -Scopes 'AuditLog.Read.All','Directory.Read.All' Get-EntraBetaAuditSignInLog -Filter "createdDateTime ge 2024-07-01T00:00:00Z and createdDateTime le 2024-07-14T23:59:59Z"</dev:code> <dev:remarks> <maml:para>This example shows how to retrieve sign-in logs between dates.</maml:para> </dev:remarks> </command:example> <command:example> <maml:title>---------- Example 5: List failed sign-ins for a user ----------</maml:title> <dev:code>Connect-Entra -Scopes 'AuditLog.Read.All','Directory.Read.All' $failedSignIns = Get-EntraBetaAuditSignInLog -Filter "userPrincipalName eq 'SawyerM@contoso.com' and status/errorCode ne 0" $failedSignIns | Select-Object UserPrincipalName, CreatedDateTime, Status, IpAddress, ClientAppUsed | Format-Table -AutoSize</dev:code> <dev:remarks> <maml:para>This example demonstrates how to retrieve failed sign-ins for a user.</maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version:</maml:linkText> <maml:uri>https://learn.microsoft.com/powershell/module/Microsoft.Entra.Beta/Get-EntraBetaAuditSignInLog</maml:uri> </maml:navigationLink> </command:relatedLinks> </command:command> </helpItems> |