Update V3.0.4 - Updates & Improvements

Improvements:

• Added -UserIds parameter to Get-Users for filtering by specific user IDs.

• Renamed function OAuthPermissionGraph to OAuthPermissionsGraph for consistency with the non-Graph variant.

• Updated Get-UALGraph:

  • Added -MaxEventsPerFile parameter to specify the maximum number of events per output file. A new file is created once this limit is reached.
  • Added -SplitFiles parameter to enable automatic splitting of output into multiple files based on the specified event limit.
  • Accepted a pull request from @marbaugh adding CSV output format support.

• Get-UAL: Improved interval calculation logic when collecting logs. Previously, in large environments, timeout errors could cause the script to exit with no results. Now, if a timeout occurs, it falls back to calculating the interval based on a 1-day data sample. Also added a validation check to compare expected and actual log counts due to occasional inconsistencies in Search-UnifiedAuditLog.

• Get-UALStatistics: Introduced retry logic (up to 3 attempts) when timeouts occur. This helps ensure more reliable results in large environments. It’s recommended to reduce the time interval when running this command in such cases.

• Get-MailboxRules: Expanded the output to include several additional fields, providing deeper visibility into mailbox rule configurations. Thanks to @evild3ad for pointing out the missing fields.

• Added Get-MailboxAuditLogLegacy, which uses the old/deperaceded way of collecting the mailbox audit logs. According to MS it should not work anymore and you should use the UAL since the logs are in there as well. However, it still seems to be working we had some cases where the UAL was disabled and we managed to get logs via this way.

• Added guidance on the differences between delegated and application permissions, clarifying usage scenarios and helping users choose the appropriate one for their needs.

Bug Fixes:

• Fixed an issue in Get-AzureActivityLogs where an error was thrown when no subscriptions were found.
• Get-MessageIDs: Added additional error handling to avoid script failure when multiple IDs are returned.
• Get-GraphEntraSignInLogs: Implemented retry and catch logic to handle re-authentication during timeout scenarios.