8,330 questions
With paging the max is 50,000 and you can back 90 days
Note that Microsoft recommends using the new GUI search now:
How to export Unified Audit logs as .CSV file using PowerShell or MS Graph?
EnterpriseArchitect
6,041
Reputation points
What is the PowerShell code equivalent for exporting the Unified Audit logs with the specific Workload like in the below screenshot?
https://compliance.microsoft.com/auditlogsearch?viewid=Async%20Search
Windows for business | Windows Server | User experience | PowerShell
Microsoft Security | Microsoft Entra | Microsoft Entra ID
25,161 questions
Microsoft Security | Microsoft Graph
13,728 questions
Accepted answer
-
Andy David - MVP 157.8K Reputation points MVP Volunteer Moderator2023-08-30T12:59:12.25+00:00 -
EnterpriseArchitect 6,041 Reputation points
2023-08-30T13:08:10.03+00:00 Thank you @Andy David - MVP ,
I assume there is no difference in the CSV exported by the PowerShell vs. the GUI link you've shared above?
Sign in to comment -
1 additional answer
Sort by: Most helpful
-
Andy David - MVP 157.8K Reputation points MVP Volunteer Moderator
2023-08-30T12:12:27.91+00:00 HI, you can use this:
https://learn.microsoft.com/en-us/purview/audit-log-search-script
-
EnterpriseArchitect 6,041 Reputation points
2023-08-30T12:40:50.0066667+00:00 Hi @Andy David - MVP ,
Thank you for the response, I assume I can change the$record = "AzureActiveDirectory" with 'PowerBIAudit' as shown in the https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#auditlogrecordtype ?
-
EnterpriseArchitect 6,041 Reputation points
2023-08-30T12:46:06.5433333+00:00 @Andy David - MVP ,
Do the Unified Audit logs limit 90 days maximum or 50,000 events only?[DateTime]$start = [DateTime]::UtcNow.AddDays(-90) [DateTime]$end = [DateTime]::UtcNow $record = "AzureActiveDirectory" $resultSize = 50000
Sign in to comment -