external help file | Module Name | online version | schema |
---|---|---|---|
Microsoft.Graph.Reports-help.xml |
Microsoft.Graph.Reports |
2.0.0 |
Get a specific Microsoft Entra audit log item. This includes an audit log item generated by various services within Microsoft Entra ID like user, application, device and group management, privileged identity management (PIM), access reviews, terms of use, identity protection, password management (self-service and admin password resets), self-service group management, and so on.
Note
To view the beta release of this cmdlet, view Get-MgBetaAuditLogDirectoryAudit
Get-MgAuditLogDirectoryAudit [-ExpandProperty <String[]>] [-Property <String[]>] [-Filter <String>]
[-Search <String>] [-Skip <Int32>] [-Sort <String[]>] [-Top <Int32>] [-ResponseHeadersVariable <String>]
[-Headers <IDictionary>] [-PageSize <Int32>] [-All] [-CountVariable <String>]
[-ProgressAction <ActionPreference>] [<CommonParameters>]
Get-MgAuditLogDirectoryAudit -DirectoryAuditId <String> [-ExpandProperty <String[]>] [-Property <String[]>]
[-ResponseHeadersVariable <String>] [-Headers <IDictionary>] [-ProgressAction <ActionPreference>]
[<CommonParameters>]
Get-MgAuditLogDirectoryAudit -InputObject <IReportsIdentity> [-ExpandProperty <String[]>]
[-Property <String[]>] [-ResponseHeadersVariable <String>] [-Headers <IDictionary>]
[-ProgressAction <ActionPreference>] [<CommonParameters>]
Get a specific Microsoft Entra audit log item. This includes an audit log item generated by various services within Microsoft Entra ID like user, application, device and group management, privileged identity management (PIM), access reviews, terms of use, identity protection, password management (self-service and admin password resets), self-service group management, and so on.
Import-Module Microsoft.Graph.Reports
Get-MgAuditLogDirectoryAudit
This example shows how to use the Get-MgAuditLogDirectoryAudit Cmdlet.
List all pages.
Type: SwitchParameter
Parameter Sets: List
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
Specifies a count of the total number of items in a collection. By default, this variable will be set in the global scope.
Type: String
Parameter Sets: List
Aliases: CV
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
The unique identifier of directoryAudit
Type: String
Parameter Sets: Get
Aliases:
Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
Expand related entities
Type: String[]
Parameter Sets: (All)
Aliases: Expand
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
Filter items by property values
Type: String
Parameter Sets: List
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
Optional headers that will be added to the request.
Type: IDictionary
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByValue)
Accept wildcard characters: False
Identity Parameter To construct, see NOTES section for INPUTOBJECT properties and create a hash table.
Type: IReportsIdentity
Parameter Sets: GetViaIdentity
Aliases:
Required: True
Position: Named
Default value: None
Accept pipeline input: True (ByValue)
Accept wildcard characters: False
Sets the page size of results.
Type: Int32
Parameter Sets: List
Aliases:
Required: False
Position: Named
Default value: 0
Accept pipeline input: False
Accept wildcard characters: False
{{ Fill ProgressAction Description }}
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
Select properties to be returned
Type: String[]
Parameter Sets: (All)
Aliases: Select
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
Optional Response Headers Variable.
Type: String
Parameter Sets: (All)
Aliases: RHV
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
Search items by search phrases
Type: String
Parameter Sets: List
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
Order items by property values
Type: String[]
Parameter Sets: List
Aliases: OrderBy
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
Show only the first n items
Type: Int32
Parameter Sets: List
Aliases: Limit
Required: False
Position: Named
Default value: 0
Accept pipeline input: False
Accept wildcard characters: False
Skip the first n items
Type: Int32
Parameter Sets: List
Aliases:
Required: False
Position: Named
Default value: 0
Accept pipeline input: False
Accept wildcard characters: False
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.
COMPLEX PARAMETER PROPERTIES
To create the parameters described below, construct a hash table containing the appropriate properties. For information on hash tables, run Get-Help about_Hash_Tables.
INPUTOBJECT <IReportsIdentity>
: Identity Parameter
[Date <DateTime?>]
: Usage: date={date}[DeviceManagementExportJobId <String>]
: The unique identifier of deviceManagementExportJob[DirectoryAuditId <String>]
: The unique identifier of directoryAudit[EndDateTime <DateTime?>]
: Usage: endDateTime={endDateTime}[Filter <String>]
: Usage: filter='{filter}'[GroupId <String>]
: Usage: groupId='{groupId}'[IncludedUserRoles <String>]
: Usage: includedUserRoles='{includedUserRoles}'[IncludedUserTypes <String>]
: Usage: includedUserTypes='{includedUserTypes}'[ManifestId <String>]
: The unique identifier of manifest[OperationId <String>]
: The unique identifier of operation[Period <String>]
: Usage: period='{period}'[PrintUsageByPrinterId <String>]
: The unique identifier of printUsageByPrinter[PrintUsageByUserId <String>]
: The unique identifier of printUsageByUser[PrinterId <String>]
: Usage: printerId='{printerId}'[ProvisioningObjectSummaryId <String>]
: The unique identifier of provisioningObjectSummary[SignInId <String>]
: The unique identifier of signIn[Skip <Int32?>]
: Usage: skip={skip}[SkipToken <String>]
: Usage: skipToken='{skipToken}'[StartDateTime <DateTime?>]
: Usage: startDateTime={startDateTime}[Top <Int32?>]
: Usage: top={top}[UserId <String>]
: Usage: userId='{userId}'[UserRegistrationDetailsId <String>]
: The unique identifier of userRegistrationDetails
https://learn.microsoft.com/powershell/module/microsoft.graph.reports/get-mgauditlogdirectoryaudit
https://learn.microsoft.com/graph/api/directoryaudit-get?view=graph-rest-1.0
https://learn.microsoft.com/graph/api/directoryaudit-list?view=graph-rest-1.0