Error when running the Script.

[irocz1997]

🐛 Summary

Hello,
Thank you for the script saving me a lot of time looking thru our environment.
I have the proper roles assigned and Auditing is turned on under security and compliance.

When I run the script I'm getting errors under these sections.
VERBOSE: Searching for 'Set domain authentication' and 'Set federation settings on domain' operations in the UAL.

The property 'Count' cannot be found on this object. Verify that the property exists.
At C:\Users\xxxxxx\Documents\Ps_scripts\solarwindsv1.ps1:331 char:13

•     If ($UALInput.Count -eq 5000)
  

•         ~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : NotSpecified: (:) [], PropertyNotFoundException
  • FullyQualifiedErrorId : PropertyNotFoundStrict

VERBOSE: Searching for 'Update application' and 'Update application ? Certificates and secrets management' in the UAL.
The property 'Organization' cannot be found on this object. Verify that the property exists.
At C:\Users\xxxxx\Documents\Ps_scripts\solarwindsv1.ps1:339 char:17

•             $DataProps = [ordered]@{
  

•             ~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : NotSpecified: (:) [], PropertyNotFoundException
  • FullyQualifiedErrorId : PropertyNotFoundStrict

The variable '$DataProps' cannot be retrieved because it has not been set.
At C:\Users\xxxxx\Documents\Ps_scripts\solarwindsv1.ps1:366 char:68

• ... $DataObj = New-Object -TypeName PSObject -Property $DataProps

VERBOSE: Searching for 'Update service principal' and 'Add service principal credentials' in the UAL.
The property 'Organization' cannot be found on this object. Verify that the property exists.
At C:\Users\xxxxx\Documents\Ps_scripts\solarwindsv1.ps1:339 char:17

•             $DataProps = [ordered]@{
  

•             ~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : NotSpecified: (:) [], PropertyNotFoundException
  • FullyQualifiedErrorId : PropertyNotFoundStrict

The variable '$DataProps' cannot be retrieved because it has not been set.
At C:\Users\xxxxx\Documents\Ps_scripts\solarwindsv1.ps1:366 char:68

• ... $DataObj = New-Object -TypeName PSObject -Property $DataProps

VERBOSE: Searching for 'Add OAuth2PermissionGrant' and 'Consent to application' in the UAL.
The property 'Organization' cannot be found on this object. Verify that the property exists.
At C:\Users\xxxxx\Documents\Ps_scripts\solarwindsv1.ps1:339 char:17

•             $DataProps = [ordered]@{
  

•             ~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : NotSpecified: (:) [], PropertyNotFoundException
  • FullyQualifiedErrorId : PropertyNotFoundStrict

The variable '$DataProps' cannot be retrieved because it has not been set.
At C:\Users\xxxxx\Documents\Ps_scripts\solarwindsv1.ps1:366 char:68

• ... $DataObj = New-Object -TypeName PSObject -Property $DataProps

VERBOSE: Searching for PowerShell logins using known PS application ids in the UAL.
The property 'Organization' cannot be found on this object. Verify that the property exists.
At C:\Users\xxxxx\Documents\Ps_scripts\solarwindsv1.ps1:339 char:17

•             $DataProps = [ordered]@{
  

•             ~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : NotSpecified: (:) [], PropertyNotFoundException
  • FullyQualifiedErrorId : PropertyNotFoundStrict

The variable '$DataProps' cannot be retrieved because it has not been set.
At C:\Users\xxxxx\Documents\Ps_scripts\solarwindsv1.ps1:366 char:68

• ... $DataObj = New-Object -TypeName PSObject -Property $DataProps

It creates 3 CSV files and the rest of the CSV files have zero bytes.

[DeemOnSecurity]

Which 3 CSVs are being created?

[irocz1997]

PSMailbox_Operations_Export.csv
ApplicationGraphPermissions.csv
Domain_List.csv

[DeemOnSecurity]

Interesting. The traceback makes it appear that the Search-UnifiedAuditLog cmdlet is not returning any data.

Can you try connecting to exchange online using powershell, then running:

[datetime] $StartDate = [DateTime]::UtcNow.AddYears(-1).AddMinutes(10)
[datetime] $EndDate = [DateTime]::UtcNow

$PSLoginData1 = Search-UnifiedAuditLog -StartDate $StartDate -EndDate $EndDate -ResultSize 5000  -FreeText "a0c73c16-a7e3-4564-9a95-2bdf47383716"

$PSLoginData1 

and see if any data is returned?

If no data is returned it could be indicative of a permissions issue and you will want to verify all permissions listed in the README.md are present.

[DeemOnSecurity]

Interesting. The traceback makes it appear that the Search-UnifiedAuditLog cmdlet is not returning any data.

Can you try connecting to exchange online using powershell, then running:

[datetime] $StartDate = [DateTime]::UtcNow.AddYears(-1).AddMinutes(10)
[datetime] $EndDate = [DateTime]::UtcNow

$PSLoginData1 = Search-UnifiedAuditLog -StartDate $StartDate -EndDate $EndDate -ResultSize 5000  -FreeText "a0c73c16-a7e3-4564-9a95-2bdf47383716"

$PSLoginData1 

and see if any data is returned?

If no data is returned it could be indicative of a permissions issue and you will want to verify all permissions listed in the README.md are present.

You should be able to connect to exchange online with the cmdlet Connect-ExchangeOnline

[irocz1997]

I'm getting data returned. I'm getting user log entries back from 5/20 to the present.

[genericdevname]

Can you try running this command (connecting to exchange online with cmdlet Connect-ExchangeOnline):

[datetime] $StartDate = [DateTime]::UtcNow.AddYears(-1).AddMinutes(10)
[datetime] $EndDate = [DateTime]::UtcNow

$testData = Search-UnifiedAuditLog -StartDate $StartDate -EndDate $EndDate -ResultSize 5000 

$testData

This will give a more generic output of the data in your environment. If data returns, that's a good first step to rule out permission issues. If it returns data, please let us know how far back it was able to get.

After running the above command, please try running this one:

[datetime] $StartDate = [DateTime]::UtcNow.AddYears(-1).AddMinutes(10)
[datetime] $EndDate = [DateTime]::UtcNow

$ConsentData = Search-UnifiedAuditLog -StartDate $StartDate -EndDate $EndDate -RecordType AzureActiveDirectory -Operations "Add OAuth2PermissionGrant","Consent to application" -ResultSize 5000

$ConsentData

Does this return data?

You can also run the other queries like this as well if you wanted to check all the operations manually.

[irocz1997]

I just went old school and rebooted the server and started the PS script over and it's working now. I now have CSV files all filled out.
Thank you for your time and Tshooting.