"invalid JSON primitive" error - Search-UnifiedAuditLog cmdlet

Question

"invalid JSON primitive" error occurred while fetching audits from Sharepoint using Search-UnifiedAuditLog cmdlet in powershell itself. Connect Exchange Online using azure certificate credentials connected successfully but audit fetch results in error for US environments. PowerShell version : 5.1

Anyone help me to resolve this.

Answer 1

Works fine here with CBA. Make sure you've assigned sufficient permissions to the service principal, you can assign Exchange-specific roles/role groups now, too.

If you are in a multi-tenant environment, make sure you're connecting to the correct endpoint. Refer to this article for more details: https://ingogegenwarth.wordpress.com/2023/05/12/the-thing-with-customrouting/

Answer 2

That error is usually caused by badly formatted Json data. E.g., a trailing comma at the end of the data, a missing square bracket, etc.

$j = @"
{
    "Object1": "x"
},
{
    "Object2": "y"
}
"@
$x = ConvertFrom-Json -InputObject $j

That yields the error:

ConvertFrom-Json : Invalid JSON primitive: 
{
    "Object2": "y"
}.

The error message in the screenshot looks a little odd, too:

etailsTOPsObject - ConvertFrom-Json $ErrorObject.ErrorDetails.Message

It looks like there's a minus sign before the ConvertFrom-Json cmdlet.