Update-MgBetaSecurityAuditLog
Update the navigation property auditLog in security
Note
To view the v1.0 release of this cmdlet, view Update-MgSecurityAuditLog
Syntax
UpdateExpanded (Default)
Update-MgBetaSecurityAuditLog
[-ResponseHeadersVariable <string>]
[-AdditionalProperties <hashtable>]
[-Id <string>]
[-Queries <IMicrosoftGraphSecurityAuditLogQuery[]>]
[-Break]
[-Headers <IDictionary>]
[-HttpPipelineAppend <SendAsyncStep[]>]
[-HttpPipelinePrepend <SendAsyncStep[]>]
[-Proxy <uri>]
[-ProxyCredential <pscredential>]
[-ProxyUseDefaultCredentials]
[-WhatIf]
[-Confirm]
[<CommonParameters>]
Update
Update-MgBetaSecurityAuditLog
-BodyParameter <IMicrosoftGraphSecurityAuditCoreRoot>
[-ResponseHeadersVariable <string>]
[-Break]
[-Headers <IDictionary>]
[-HttpPipelineAppend <SendAsyncStep[]>]
[-HttpPipelinePrepend <SendAsyncStep[]>]
[-Proxy <uri>]
[-ProxyCredential <pscredential>]
[-ProxyUseDefaultCredentials]
[-WhatIf]
[-Confirm]
[<CommonParameters>]
Parameters
-AdditionalProperties
Additional Parameters
Parameter properties
| Type: | System.Collections.Hashtable |
| Supports wildcards: | False |
| DontShow: | False |
Parameter sets
UpdateExpanded
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
-BodyParameter
Root entity for the audit log API. To construct, see NOTES section for BODYPARAMETER properties and create a hash table.
Parameter properties
| Type: | Microsoft.Graph.Beta.PowerShell.Models.IMicrosoftGraphSecurityAuditCoreRoot |
| Supports wildcards: | False |
| DontShow: | False |
Parameter sets
Update
| Position: | Named |
| Mandatory: | True |
| Value from pipeline: | True |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
-Break
Wait for .NET debugger to attach
Parameter properties
| Type: | System.Management.Automation.SwitchParameter |
| Default value: | False |
| Supports wildcards: | False |
| DontShow: | False |
Parameter sets
(All)
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
-Confirm
Prompts you for confirmation before running the cmdlet.
Parameter properties
| Type: | System.Management.Automation.SwitchParameter |
| Supports wildcards: | False |
| DontShow: | False |
| Aliases: | cf |
Parameter sets
(All)
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
-Headers
Optional headers that will be added to the request.
Parameter properties
| Type: | System.Collections.IDictionary |
| Supports wildcards: | False |
| DontShow: | False |
Parameter sets
(All)
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | True |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
-HttpPipelineAppend
SendAsync Pipeline Steps to be appended to the front of the pipeline
Parameter properties
| Type: | Microsoft.Graph.Beta.PowerShell.Runtime.SendAsyncStep[] |
| Supports wildcards: | False |
| DontShow: | False |
Parameter sets
(All)
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
-HttpPipelinePrepend
SendAsync Pipeline Steps to be prepended to the front of the pipeline
Parameter properties
| Type: | Microsoft.Graph.Beta.PowerShell.Runtime.SendAsyncStep[] |
| Supports wildcards: | False |
| DontShow: | False |
Parameter sets
(All)
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
-Id
The unique identifier for an entity. Read-only.
Parameter properties
| Type: | System.String |
| Supports wildcards: | False |
| DontShow: | False |
Parameter sets
UpdateExpanded
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
-Proxy
The URI for the proxy server to use
Parameter properties
| Type: | System.Uri |
| Supports wildcards: | False |
| DontShow: | False |
Parameter sets
(All)
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
-ProxyCredential
Credentials for a proxy server to use for the remote call
Parameter properties
| Type: | System.Management.Automation.PSCredential |
| Supports wildcards: | False |
| DontShow: | False |
Parameter sets
(All)
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
-ProxyUseDefaultCredentials
Use the default credentials for the proxy
Parameter properties
| Type: | System.Management.Automation.SwitchParameter |
| Default value: | False |
| Supports wildcards: | False |
| DontShow: | False |
Parameter sets
(All)
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
-Queries
To construct, see NOTES section for QUERIES properties and create a hash table.
Parameter properties
| Type: | Microsoft.Graph.Beta.PowerShell.Models.IMicrosoftGraphSecurityAuditLogQuery[] |
| Supports wildcards: | False |
| DontShow: | False |
Parameter sets
UpdateExpanded
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
-ResponseHeadersVariable
Optional Response Headers Variable.
Parameter properties
| Type: | System.String |
| Supports wildcards: | False |
| DontShow: | False |
| Aliases: | RHV |
Parameter sets
(All)
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
-WhatIf
Runs the command in a mode that only reports what would happen without performing the actions.
Parameter properties
| Type: | System.Management.Automation.SwitchParameter |
| Supports wildcards: | False |
| DontShow: | False |
| Aliases: | wi |
Parameter sets
(All)
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.
Inputs
Microsoft.Graph.Beta.PowerShell.Models.IMicrosoftGraphSecurityAuditCoreRoot
{{ Fill in the Description }}
System.Collections.IDictionary
{{ Fill in the Description }}
Outputs
Microsoft.Graph.Beta.PowerShell.Models.IMicrosoftGraphSecurityAuditCoreRoot
{{ Fill in the Description }}
Notes
COMPLEX PARAMETER PROPERTIES
To create the parameters described below, construct a hash table containing the appropriate properties. For information on hash tables, run Get-Help about_Hash_Tables.
BODYPARAMETER <IMicrosoftGraphSecurityAuditCoreRoot>: Root entity for the audit log API.
[(Any) <Object>]: This indicates any property can be added to this object.
[Id <String>]: The unique identifier for an entity.
Read-only.
[Queries <IMicrosoftGraphSecurityAuditLogQuery[]>]:
[Id <String>]: The unique identifier for an entity.
Read-only.
[AdministrativeUnitIdFilters <String[]>]: The administrative units tagged to an audit log record.
[DisplayName <String>]: The display name of the saved audit log query.
[FilterEndDateTime <DateTime?>]: The end date of the date range in the query.
[FilterStartDateTime <DateTime?>]: The start date of the date range in the query.
[IPAddressFilters <String[]>]: The IP address of the device that was used when the activity was logged.
[KeywordFilter <String>]: Free text field to search non-indexed properties of the audit log.
[ObjectIdFilters <String[]>]: For SharePoint and OneDrive for Business activity, the full path name of the file or folder accessed by the user.
For Exchange admin audit logging, the name of the object that was modified by the cmdlet.
[OperationFilters <String[]>]: The name of the user or admin activity.
For a description of the most common operations/activities, see Search the audit log in the Office 365 Protection Center.
[RecordTypeFilters <String[]>]: The type of operation indicated by the record.
For the list of member values, see auditLogRecordType.
[Records <IMicrosoftGraphSecurityAuditLogRecord[]>]: An individual audit log record.
[Id <String>]: The unique identifier for an entity.
Read-only.
[AdministrativeUnits <String[]>]: The administrative units tagged to an audit log record.
[AuditData <IMicrosoftGraphSecurityAuditData>]: Abstract base type for audit event data.
[(Any) <Object>]: This indicates any property can be added to this object.
[DynamicProperties <IMicrosoftGraphSecurityAuditRecordTypeDictionary>]: A dictionary of name-value pairs for dynamic audit event properties.
[(Any) <Object>]: This indicates any property can be added to this object.
[AuditLogRecordType <String>]: Specifies the type of audit log record.
[ClientIP <String>]: The IP address of the device used when the activity was logged.
The IP address is displayed in either an IPv4 or IPv6 address format.
[CreatedDateTime <DateTime?>]: The date and time in UTC when the user performed the activity.
[ObjectId <String>]: For Exchange admin audit logging, the name of the object modified by the cmdlet.
For SharePoint activity, the full URL path name of the file or folder accessed by a user.
For Microsoft Entra activity, the name of the user account that was modified.
[Operation <String>]: The name of the user or admin activity.
[OrganizationId <String>]: The GUID for your organization.
[Service <String>]: The Microsoft 365 service where the activity occurred.
[UserId <String>]: The user who performed the action (specified in the Operation property) that resulted in the record being logged.
Audit records for activity performed by system accounts (such as SHAREPOINT/system or NT AUTHORITY/SYSTEM) are also included in the audit log.
Another common value for the UserId property is app@sharepoint.
It indicates that the 'user' who performed the activity was an application with the necessary permissions in SharePoint to perform organization-wide actions (such as searching a SharePoint site or OneDrive account) on behalf of a user, admin, or service.
[UserPrincipalName <String>]: UPN of the user who performed the action.
[UserType <String>]: Type of user associated with an audit log record.
[ServiceFilters <String[]>]:
[Status <String>]: Status of an audit log query.
[UserPrincipalNameFilters <String[]>]: The UPN (user principal name) of the user who performed the action (specified in the operation property) that resulted in the record being logged; for example, myname@mydomain_name.
QUERIES <IMicrosoftGraphSecurityAuditLogQuery[]>: . [Id <String>]: The unique identifier for an entity. Read-only. [AdministrativeUnitIdFilters <String[]>]: The administrative units tagged to an audit log record. [DisplayName <String>]: The display name of the saved audit log query. [FilterEndDateTime <DateTime?>]: The end date of the date range in the query. [FilterStartDateTime <DateTime?>]: The start date of the date range in the query. [IPAddressFilters <String[]>]: The IP address of the device that was used when the activity was logged. [KeywordFilter <String>]: Free text field to search non-indexed properties of the audit log. [ObjectIdFilters <String[]>]: For SharePoint and OneDrive for Business activity, the full path name of the file or folder accessed by the user. For Exchange admin audit logging, the name of the object that was modified by the cmdlet. [OperationFilters <String[]>]: The name of the user or admin activity. For a description of the most common operations/activities, see Search the audit log in the Office 365 Protection Center. [RecordTypeFilters <String[]>]: The type of operation indicated by the record. For the list of member values, see auditLogRecordType. [Records <IMicrosoftGraphSecurityAuditLogRecord[]>]: An individual audit log record. [Id <String>]: The unique identifier for an entity. Read-only. [AdministrativeUnits <String[]>]: The administrative units tagged to an audit log record. [AuditData <IMicrosoftGraphSecurityAuditData>]: Abstract base type for audit event data. [(Any) <Object>]: This indicates any property can be added to this object. [DynamicProperties <IMicrosoftGraphSecurityAuditRecordTypeDictionary>]: A dictionary of name-value pairs for dynamic audit event properties. [(Any) <Object>]: This indicates any property can be added to this object. [AuditLogRecordType <String>]: Specifies the type of audit log record. [ClientIP <String>]: The IP address of the device used when the activity was logged. The IP address is displayed in either an IPv4 or IPv6 address format. [CreatedDateTime <DateTime?>]: The date and time in UTC when the user performed the activity. [ObjectId <String>]: For Exchange admin audit logging, the name of the object modified by the cmdlet. For SharePoint activity, the full URL path name of the file or folder accessed by a user. For Microsoft Entra activity, the name of the user account that was modified. [Operation <String>]: The name of the user or admin activity. [OrganizationId <String>]: The GUID for your organization. [Service <String>]: The Microsoft 365 service where the activity occurred. [UserId <String>]: The user who performed the action (specified in the Operation property) that resulted in the record being logged. Audit records for activity performed by system accounts (such as SHAREPOINT/system or NT AUTHORITY/SYSTEM) are also included in the audit log. Another common value for the UserId property is app@sharepoint. It indicates that the 'user' who performed the activity was an application with the necessary permissions in SharePoint to perform organization-wide actions (such as searching a SharePoint site or OneDrive account) on behalf of a user, admin, or service. [UserPrincipalName <String>]: UPN of the user who performed the action. [UserType <String>]: Type of user associated with an audit log record. [ServiceFilters <String[]>]: [Status <String>]: Status of an audit log query. [UserPrincipalNameFilters <String[]>]: The UPN (user principal name) of the user who performed the action (specified in the operation property) that resulted in the record being logged; for example, myname@mydomain_name.