How to search audit log using just email domain

Question

I'm using an example PowerShell script from this documentation to get an audit log report

https://learn.microsoft.com/en-us/microsoft-365/compliance/audit-log-search-script?view=o365-worldwide

but I'm just wondering if there is a way to search all the activity log for all the user that have a domain like this "@ssss .com" ?

I don't know their UPN so just want to do global/wild search using just the email domain and get all the activities.

Answer 1

You could use the following command Search-UnifiedAuditLog with UserIds parameter.

The UserIds parameter filters the log entries by the account (UserPrincipalName) of the user who performed the action. For example, laura@Company portal .onmicrosoft.com.
You can enter multiple values separated by commas. If the values contain spaces or otherwise require quotation marks, use the following syntax: "Value1","Value2",..."ValueN".

More details: https://learn.microsoft.com/en-us/powershell/module/exchange/search-unifiedauditlog?view=exchange-ps

This means that you will have to provide a list of the users using that @keyman .com

This can be by obtained by using a:
Get-AzureADUser | Select UserPrincipalName

And filter out the results to have only users with the domain you want.