Get-MgAuditLogSignIn

Module:

Microsoft.Graph.Reports

Retrieve a specific Microsoft Entra user sign-in event for your tenant. Sign-ins that are interactive in nature (where a username/password is passed as part of auth token) and successful federated sign-ins are currently included in the sign-in logs.

Note

To view the beta release of this cmdlet, view Get-MgBetaAuditLogSignIn

Syntax

Get-MgAuditLogSignIn
   [-ExpandProperty <String[]>]
   [-Property <String[]>]
   [-Filter <String>]
   [-Search <String>]
   [-Skip <Int32>]
   [-Sort <String[]>]
   [-Top <Int32>]
   [-ResponseHeadersVariable <String>]
   [-Headers <IDictionary>]
   [-PageSize <Int32>]
   [-All]
   [-CountVariable <String>]
   [-ProgressAction <ActionPreference>]
   [<CommonParameters>]

Get-MgAuditLogSignIn
   -SignInId <String>
   [-ExpandProperty <String[]>]
   [-Property <String[]>]
   [-ResponseHeadersVariable <String>]
   [-Headers <IDictionary>]
   [-ProgressAction <ActionPreference>]
   [<CommonParameters>]

Get-MgAuditLogSignIn
   -InputObject <IReportsIdentity>
   [-ExpandProperty <String[]>]
   [-Property <String[]>]
   [-ResponseHeadersVariable <String>]
   [-Headers <IDictionary>]
   [-ProgressAction <ActionPreference>]
   [<CommonParameters>]

Description

Retrieve a specific Microsoft Entra user sign-in event for your tenant. Sign-ins that are interactive in nature (where a username/password is passed as part of auth token) and successful federated sign-ins are currently included in the sign-in logs.

Examples

Example 1: List all sign-ins

Import-Module Microsoft.Graph.Reports

Get-MgAuditLogSignIn

This example will list all sign-ins

Example 2: Retrieve the first 10 sign-ins to apps with the appDisplayName that starts with 'Graph'

Import-Module Microsoft.Graph.Reports

Get-MgAuditLogSignIn -Filter "startsWith(appDisplayName,'Graph')" -Top 10

This example will retrieve the first 10 sign-ins to apps with the appdisplayname that starts with 'graph'

Parameters

-All

List all pages.

Type:	SwitchParameter
Position:	Named
Default value:	False
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-CountVariable

Specifies a count of the total number of items in a collection. By default, this variable will be set in the global scope.

Type:	String
Aliases:	CV
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-ExpandProperty

Expand related entities

Type:	String[]
Aliases:	Expand
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-Filter

Filter items by property values

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-Headers

Optional headers that will be added to the request.

Type:	IDictionary
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	True
Accept wildcard characters:	False

-InputObject

Identity Parameter To construct, see NOTES section for INPUTOBJECT properties and create a hash table.

Type:	IReportsIdentity
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	True
Accept wildcard characters:	False

-PageSize

Sets the page size of results.

Type:	Int32
Position:	Named
Default value:	0
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-ProgressAction

{{ Fill ProgressAction Description }}

Type:	ActionPreference
Aliases:	proga
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-Property

Select properties to be returned

Type:	String[]
Aliases:	Select
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-ResponseHeadersVariable

Optional Response Headers Variable.

Type:	String
Aliases:	RHV
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-Search

Search items by search phrases

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-SignInId

The unique identifier of signIn

Type:	String
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	False
Accept wildcard characters:	False

-Skip

Skip the first n items

Type:	Int32
Position:	Named
Default value:	0
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-Sort

Order items by property values

Type:	String[]
Aliases:	OrderBy
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-Top

Show only the first n items

Type:	Int32
Aliases:	Limit
Position:	Named
Default value:	0
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

Inputs

Microsoft.Graph.PowerShell.Models.IReportsIdentity

System.Collections.IDictionary

Outputs

Microsoft.Graph.PowerShell.Models.IMicrosoftGraphSignIn

Notes

COMPLEX PARAMETER PROPERTIES

To create the parameters described below, construct a hash table containing the appropriate properties. For information on hash tables, run Get-Help about_Hash_Tables.

INPUTOBJECT <IReportsIdentity>: Identity Parameter

• [Date <DateTime?>]: Usage: date={date}
• [DeviceManagementExportJobId <String>]: The unique identifier of deviceManagementExportJob
• [DirectoryAuditId <String>]: The unique identifier of directoryAudit
• [EndDateTime <DateTime?>]: Usage: endDateTime={endDateTime}
• [Filter <String>]: Usage: filter='{filter}'
• [GroupId <String>]: Usage: groupId='{groupId}'
• [IncludedUserRoles <String>]: Usage: includedUserRoles='{includedUserRoles}'
• [IncludedUserTypes <String>]: Usage: includedUserTypes='{includedUserTypes}'
• [ManifestId <String>]: The unique identifier of manifest
• [OperationId <String>]: The unique identifier of operation
• [Period <String>]: Usage: period='{period}'
• [PrintUsageByPrinterId <String>]: The unique identifier of printUsageByPrinter
• [PrintUsageByUserId <String>]: The unique identifier of printUsageByUser
• [PrinterId <String>]: Usage: printerId='{printerId}'
• [ProvisioningObjectSummaryId <String>]: The unique identifier of provisioningObjectSummary
• [SignInId <String>]: The unique identifier of signIn
• [Skip <Int32?>]: Usage: skip={skip}
• [SkipToken <String>]: Usage: skipToken='{skipToken}'
• [StartDateTime <DateTime?>]: Usage: startDateTime={startDateTime}
• [Top <Int32?>]: Usage: top={top}
• [UserId <String>]: Usage: userId='{userId}'
• [UserRegistrationDetailsId <String>]: The unique identifier of userRegistrationDetails

Related Links

• Get-MgBetaAuditLogSignIn
• https://learn.microsoft.com/powershell/module/microsoft.graph.reports/get-mgauditlogsignin