
Hi @john john
You could try this code:
#Set-ExecutionPolicy RemoteSigned
# Option 1 - This can be used to be prompted for credentials
$UserCredential = Get-Credential
# Create the session to Exchange Online
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -Uri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection
# Import the Exchange Online commands
Import-PSSession $Session
$csvFile = "c:\test\auditlog2.csv"
# Setup our start and end dates to pull back events
#$start = Get-Date
$end = Get-Date
$start = $end.AddDays(-1)
$i = 1;
$startTime = Get-Date
do
{
$AuditData = Search-UnifiedAuditLog -StartDate $start -EndDate $end -RecordType SharePointFileOperation -ResultSize 5000 -SessionCommand ReturnLargeSet -SessionId "ExtractLogs" -SiteIds yoursiteid
$ConvertedOutput = $AuditData | Select-Object -ExpandProperty AuditData | ConvertFrom-Json
$ConvertedOutput | SELECT CreationTime,UserId,Operation,Workload,ObjectID,SiteUrl,SourceFileName,ClientIP,UserAgent | Export-csv $csvFile -NoTypeInformation -Append -Force
Write-Host $i++ . $AuditData.Count
$i = $i + 1;
}
Until($AuditData.Count -eq 0)
$endTime = Get-Date
Write-Host $startTime - $endTime
#Load SharePoint CSOM Assemblies
Add-Type -Path "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\ISAPI\Microsoft.SharePoint.Client.dll"
Add-Type -Path "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\ISAPI\Microsoft.SharePoint.Client.Runtime.dll"
#Get Site Id
$credential = Get-Credential
$context = New-Object Microsoft.SharePoint.Client.ClientContext("yoursiteurl")
$context.Credentials = New-Object Microsoft.SharePoint.Client.SharePointOnlineCredentials($credential.UserName,$credential.Password)
$site = $context.Site
$context.Load($site)
$context.ExecuteQuery();
$site.Id
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.