Dela via


Get-MgBetaAuditLogSignIn

Get a signIn object that contains a specific user sign-in event for your tenant that includes sign-ins where a user is asked to enter a username or password, and session tokens.

Note

To view the v1.0 release of this cmdlet, view Get-MgAuditLogSignIn

Syntax

Get-MgBetaAuditLogSignIn
   [-ExpandProperty <String[]>]
   [-Property <String[]>]
   [-Filter <String>]
   [-Search <String>]
   [-Skip <Int32>]
   [-Sort <String[]>]
   [-Top <Int32>]
   [-ResponseHeadersVariable <String>]
   [-Headers <IDictionary>]
   [-PageSize <Int32>]
   [-All]
   [-CountVariable <String>]
   [-ProgressAction <ActionPreference>]
   [<CommonParameters>]
Get-MgBetaAuditLogSignIn
   -SignInId <String>
   [-ExpandProperty <String[]>]
   [-Property <String[]>]
   [-ResponseHeadersVariable <String>]
   [-Headers <IDictionary>]
   [-ProgressAction <ActionPreference>]
   [<CommonParameters>]
Get-MgBetaAuditLogSignIn
   -InputObject <IReportsIdentity>
   [-ExpandProperty <String[]>]
   [-Property <String[]>]
   [-ResponseHeadersVariable <String>]
   [-Headers <IDictionary>]
   [-ProgressAction <ActionPreference>]
   [<CommonParameters>]

Description

Get a signIn object that contains a specific user sign-in event for your tenant that includes sign-ins where a user is asked to enter a username or password, and session tokens.

Examples

Example 1: List all sign-ins

Import-Module Microsoft.Graph.Beta.Reports

Get-MgBetaAuditLogSignIn

This example will list all sign-ins

Example 2: Retrieve the first 10 sign-ins to apps with the appDisplayName that starts with 'Azure'

Import-Module Microsoft.Graph.Beta.Reports

Get-MgBetaAuditLogSignIn -Filter "startsWith(appDisplayName,'Azure')" -Top 10

This example will retrieve the first 10 sign-ins to apps with the appdisplayname that starts with 'azure'

Example 3: Retrieve the first 10 sign-ins where the signInEventType is not interactiveUser starting with the latest sign-in

Import-Module Microsoft.Graph.Beta.Reports

Get-MgBetaAuditLogSignIn -Filter "(signInEventTypes/any(t: t ne 'interactiveUser'))" -Sort "createdDateTime DESC" -Top 10

This example will retrieve the first 10 sign-ins where the signineventtype is not interactiveuser starting with the latest sign-in

Parameters

-All

List all pages.

Type:SwitchParameter
Position:Named
Default value:False
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-CountVariable

Specifies a count of the total number of items in a collection. By default, this variable will be set in the global scope.

Type:String
Aliases:CV
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-ExpandProperty

Expand related entities

Type:String[]
Aliases:Expand
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-Filter

Filter items by property values

Type:String
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-Headers

Optional headers that will be added to the request.

Type:IDictionary
Position:Named
Default value:None
Required:False
Accept pipeline input:True
Accept wildcard characters:False

-InputObject

Identity Parameter To construct, see NOTES section for INPUTOBJECT properties and create a hash table.

Type:IReportsIdentity
Position:Named
Default value:None
Required:True
Accept pipeline input:True
Accept wildcard characters:False

-PageSize

Sets the page size of results.

Type:Int32
Position:Named
Default value:0
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-ProgressAction

{{ Fill ProgressAction Description }}

Type:ActionPreference
Aliases:proga
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-Property

Select properties to be returned

Type:String[]
Aliases:Select
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-ResponseHeadersVariable

Optional Response Headers Variable.

Type:String
Aliases:RHV
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

Search items by search phrases

Type:String
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-SignInId

The unique identifier of signIn

Type:String
Position:Named
Default value:None
Required:True
Accept pipeline input:False
Accept wildcard characters:False

-Skip

Skip the first n items

Type:Int32
Position:Named
Default value:0
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-Sort

Order items by property values

Type:String[]
Aliases:OrderBy
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-Top

Show only the first n items

Type:Int32
Aliases:Limit
Position:Named
Default value:0
Required:False
Accept pipeline input:False
Accept wildcard characters:False

Inputs

Microsoft.Graph.Beta.PowerShell.Models.IReportsIdentity

System.Collections.IDictionary

Outputs

Microsoft.Graph.Beta.PowerShell.Models.IMicrosoftGraphSignIn

Notes

COMPLEX PARAMETER PROPERTIES

To create the parameters described below, construct a hash table containing the appropriate properties. For information on hash tables, run Get-Help about_Hash_Tables.

INPUTOBJECT <IReportsIdentity>: Identity Parameter

  • [ActiveUsersBreakdownMetricId <String>]: The unique identifier of activeUsersBreakdownMetric
  • [ActiveUsersMetricId <String>]: The unique identifier of activeUsersMetric
  • [AppCredentialSignInActivityId <String>]: The unique identifier of appCredentialSignInActivity
  • [ApplicationSignInDetailedSummaryId <String>]: The unique identifier of applicationSignInDetailedSummary
  • [AuthenticationsMetricId <String>]: The unique identifier of authenticationsMetric
  • [CredentialUserRegistrationDetailsId <String>]: The unique identifier of credentialUserRegistrationDetails
  • [CustomSecurityAttributeAuditId <String>]: The unique identifier of customSecurityAttributeAudit
  • [DailyInactiveUsersByApplicationMetricId <String>]: The unique identifier of dailyInactiveUsersByApplicationMetric
  • [DailyInactiveUsersMetricId <String>]: The unique identifier of dailyInactiveUsersMetric
  • [Date <DateTime?>]: Usage: date={date}
  • [DeviceManagementCachedReportConfigurationId <String>]: The unique identifier of deviceManagementCachedReportConfiguration
  • [DeviceManagementExportJobId <String>]: The unique identifier of deviceManagementExportJob
  • [DirectoryAuditId <String>]: The unique identifier of directoryAudit
  • [EndDateTime <DateTime?>]: Usage: endDateTime={endDateTime}
  • [ExclusiveIntervalEndDateTime <DateTime?>]: Usage: exclusiveIntervalEndDateTime={exclusiveIntervalEndDateTime}
  • [Filter <String>]: Usage: filter='{filter}'
  • [GroupId <String>]: Usage: groupId='{groupId}'
  • [IncludedUserRoles <String>]: Usage: includedUserRoles='{includedUserRoles}'
  • [IncludedUserTypes <String>]: Usage: includedUserTypes='{includedUserTypes}'
  • [InclusiveIntervalStartDateTime <DateTime?>]: Usage: inclusiveIntervalStartDateTime={inclusiveIntervalStartDateTime}
  • [InsightSummaryId <String>]: The unique identifier of insightSummary
  • [ManifestId <String>]: The unique identifier of manifest
  • [MfaCompletionMetricId <String>]: The unique identifier of mfaCompletionMetric
  • [MonthlyInactiveUsersByApplicationMetricId <String>]: The unique identifier of monthlyInactiveUsersByApplicationMetric
  • [MonthlyInactiveUsersMetricId <String>]: The unique identifier of monthlyInactiveUsersMetric
  • [OperationId <String>]: The unique identifier of operation
  • [Period <String>]: Usage: period='{period}'
  • [PrintUsageByPrinterId <String>]: The unique identifier of printUsageByPrinter
  • [PrintUsageByUserId <String>]: The unique identifier of printUsageByUser
  • [PrintUsageId <String>]: The unique identifier of printUsage
  • [PrinterId <String>]: Usage: printerId='{printerId}'
  • [ProvisioningObjectSummaryId <String>]: The unique identifier of provisioningObjectSummary
  • [ServicePrincipalSignInActivityId <String>]: The unique identifier of servicePrincipalSignInActivity
  • [SignInId <String>]: The unique identifier of signIn
  • [Skip <Int32?>]: Usage: skip={skip}
  • [SkipToken <String>]: Usage: skipToken='{skipToken}'
  • [StartDateTime <DateTime?>]: Usage: startDateTime={startDateTime}
  • [Top <Int32?>]: Usage: top={top}
  • [UserCountMetricId <String>]: The unique identifier of userCountMetric
  • [UserCredentialUsageDetailsId <String>]: The unique identifier of userCredentialUsageDetails
  • [UserId <String>]: Usage: userId='{userId}'
  • [UserRegistrationDetailsId <String>]: The unique identifier of userRegistrationDetails
  • [UserRequestsMetricId <String>]: The unique identifier of userRequestsMetric
  • [UserSignUpMetricId <String>]: The unique identifier of userSignUpMetric