Get-MgAuditLogSignIn - example usage of InputObject #3312
trahman-hm
started this conversation in
General
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
-
I'm trying to generate large extracts of user sign-in logs from our EntraID tenant, using the powershell Get-MgAuditLogSignIn tool. There seem to be some limitations in the ability to generate large extracts (hundreds of thousands, if not millions of rows) of sign in logs.
I was thinking of using the INPUTOBJECT option for the command to programmatically break up a query (say for the past 30 days of all my users) into single-day blocks and then submit those single-day blocks in for extraction, then aggregate the results into a single CSV file.
Unfortunately, when I try to use INPUTOBJECT, it seems hung up on the identification of a "SignInId" as part of the included parameters. If I try this:
Import-Module Microsoft.Graph.Reports
Connect-MgGraph -Scopes "AuditLog.Read.All"
$start_date = Get-Date
$end_date = $start_date.AddDays(+1)
$params = @{
StartDateTime = $start_date
EndDateTime = $end_date
}
Get-MgAuditLogSignIn -InputObject $params
I get the following error:
Get-MgAuditLogSignIn_GetViaIdentity: The pipeline has been stopped.
Get-MgAuditLogSignIn_GetViaIdentity: InputObject has null value for InputObject.SignInId
I'm not sure what "SignInId" is a reference to - I tried to include a reference to my own Id, but that seems to fail:
Import-Module Microsoft.Graph.Reports
Connect-MgGraph -Scopes "AuditLog.Read.All"
$context = Get-MgContext
$currentUser = (Get-MgUser -UserId $context.Account).Id
$start_date = Get-Date
$end_date = $start_date.AddDays(+1)
$params = @{
SignInId = $currentUser
StartDateTime = $start_date
EndDateTime = $end_date
}
Get-MgAuditLogSignIn -InputObject $params
I get the following error:
Get-MgAuditLogSignIn_GetViaIdentity: No record found for key: ##myID## (where it dieplays my ID)
Any suggestions as to how to get this working? Even any examples on a working INPUTOBJECT hash table for the command would help.
Beta Was this translation helpful? Give feedback.
All reactions