{"id":52295,"date":"2023-09-07T09:50:59","date_gmt":"2023-09-07T09:50:59","guid":{"rendered":"https:\/\/infrasos.com\/?p=52295"},"modified":"2023-09-07T09:52:20","modified_gmt":"2023-09-07T09:52:20","slug":"automating-azure-ad-auditing-powershell-simplifying-log-analysis","status":"publish","type":"post","link":"https:\/\/infrasos.com\/automating-azure-ad-auditing-powershell-simplifying-log-analysis\/","title":{"rendered":"Automating Azure AD Auditing PowerShell: Simplifying Log Analysis"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"52295\" class=\"elementor elementor-52295\">\n\t\t\t\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-a8a4531 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"a8a4531\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-60bcfd4 ot-flex-column-vertical\" data-id=\"60bcfd4\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-e7599b5 elementor-widget elementor-widget-text-editor\" data-id=\"e7599b5\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.12.2 - 23-04-2023 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#69727d;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#69727d;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t<p>Automating Azure AD Auditing PowerShell: Simplifying Log Analysis. Do you want to simplify Azure AD auditing by automating it with PowerShell? We guide you through the various ways to accomplish this, starting with an overview of Azure AD auditing.<\/p><p>In the overview section, explain the Azure Active Directory audit and sign-in logs and the information they provide. After that, the article dives into 2 ways to use PowerShell to automate Azure AD auditing: log analysis and retention configuration.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t<div class=\"elementor-element elementor-element-7a9bb16 e-con-boxed e-con\" data-id=\"7a9bb16\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-700c399 elementor-widget elementor-widget-text-editor\" data-id=\"700c399\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/how-to-automate-azure-ad-rbac-role-management-with-powershell\/\">How to Automate Azure AD RBAC Role Management with PowerShell<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-a83400a ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"a83400a\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-5a6957c ot-flex-column-vertical\" data-id=\"5a6957c\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-b0c8693 elementor-widget elementor-widget-heading\" data-id=\"b0c8693\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.12.2 - 23-04-2023 *\/\n.elementor-heading-title{padding:0;margin:0;line-height:1}.elementor-widget-heading .elementor-heading-title[class*=elementor-size-]>a{color:inherit;font-size:inherit;line-height:inherit}.elementor-widget-heading .elementor-heading-title.elementor-size-small{font-size:15px}.elementor-widget-heading .elementor-heading-title.elementor-size-medium{font-size:19px}.elementor-widget-heading .elementor-heading-title.elementor-size-large{font-size:29px}.elementor-widget-heading .elementor-heading-title.elementor-size-xl{font-size:39px}.elementor-widget-heading .elementor-heading-title.elementor-size-xxl{font-size:59px}<\/style><h2 class=\"elementor-heading-title elementor-size-large\">Overview of Automating Azure AD Auditing with PowerShell<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1d5bc2d elementor-widget elementor-widget-text-editor\" data-id=\"1d5bc2d\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Azure Active Directory provides <a href=\"https:\/\/infrasos.com\/analyze-azure-ad-security-logs-audit-monitor-azure-ad-activity\/\">audit logs<\/a> and <a href=\"https:\/\/infrasos.com\/check-azure-ad-audit-logs-for-user-sign-ins-success-and-failures\/\">sign-in logs<\/a>. In comparison, sign-in logs track user and application sign-in, and audit logs record activities on Azure AD after successful sign-in.<\/p><p>In terms of records, <a href=\"https:\/\/infrasos.com\/get-azureadauditsigninlogs-find-sign-in-logs-for-last-30-days-with-powershell\/\">sign-in logs<\/a> record information such as the<a href=\"https:\/\/infrasos.com\/office-365-reporting\/office-365-user-reports\/\"> user that signed in<\/a>, the application they signed in to, and the status of the sign-in. Additionally, this log saves other information like the sign-in device&#8217;s IP address and the location of the user\/device.<\/p><p>Similarly, the audit log tracks information such as the user who performed the activity, the activity performed, and the status of the action.<\/p><p>Most admins use the Azure Portal to run audit and sign-in log reports. However, for admins that need to automate this process, PowerShell provides a robust option.<\/p><p>In the following sections, we explore how to use PowerShell for automating and auditing Azure AD sign-in and audit logs.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-c66dbfd ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"c66dbfd\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-a929f70 ot-flex-column-vertical\" data-id=\"a929f70\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-ec23c51 elementor-widget elementor-widget-heading\" data-id=\"ec23c51\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-large\">Automating Azure AD Auditing with PowerShell: Analysing Audit Logs<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7ec0a93 elementor-widget elementor-widget-text-editor\" data-id=\"7ec0a93\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>The<a href=\"https:\/\/infrasos.com\/top-15-office-365-powershell-commands-users-groups-licensing\/\"> PowerShell commands<\/a> required to analyse Azure AD audit and sign-in logs are part of the <a href=\"https:\/\/learn.microsoft.com\/en-us\/powershell\/azure\/active-directory\/install-adv2?view=azureadps-2.0\" target=\"_blank\" rel=\"noopener\">AzureADPreview<\/a> module. Therefore, before running the commands, you must install and import this module on your computer.\u00a0<\/p><p>After installing the module, it is also required to run the <a href=\"https:\/\/infrasos.com\/connect-azuread-how-to-connect-to-azure-ad-using-powershell\/\" rel=\"noopener\">connect-AzureAD command<\/a> before running any other command. The first subsection below explains how to install the module and run the connect-AzureAD command.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t<div class=\"elementor-element elementor-element-056aa2b e-con-boxed e-con\" data-id=\"056aa2b\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-2ac7c54 elementor-widget elementor-widget-text-editor\" data-id=\"2ac7c54\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0\u00a0<a href=\"https:\/\/infrasos.com\/automate-security-tasks-and-workflows-in-your-azure-environment\/\">Automate Security Tasks and Workflows in Your Azure Environment<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-31427f4 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"31427f4\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-c10d5dd ot-flex-column-vertical\" data-id=\"c10d5dd\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-89d94ad elementor-widget elementor-widget-heading\" data-id=\"89d94ad\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-large\">Install AzureADPreview and Connect to Azure AD Tenant<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f356bd6 elementor-widget elementor-widget-text-editor\" data-id=\"f356bd6\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>1. Search &#8220;powershell&#8221; (without the quotes) and select &#8220;Run as administrator.&#8221; Your PC prompts you to authorize the app to make changes to your device &#8211; click Yes.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-21a6999 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"21a6999\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-6f67d99 ot-flex-column-vertical\" data-id=\"6f67d99\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-092f245 elementor-widget elementor-widget-image\" data-id=\"092f245\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.12.2 - 23-04-2023 *\/\n.elementor-widget-image{text-align:center}.elementor-widget-image a{display:inline-block}.elementor-widget-image a img[src$=\".svg\"]{width:48px}.elementor-widget-image img{vertical-align:middle;display:inline-block}<\/style>\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Automating-Azure-AD-Auditing-with-PowerShell-install-AzureADPreview-module-open-PowerShell-as-administrator.jpg\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Automating Azure AD Auditing PowerShell: Simplifying Log Analysis\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NTIzNjYsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzA4XC9BdXRvbWF0aW5nLUF6dXJlLUFELUF1ZGl0aW5nLXdpdGgtUG93ZXJTaGVsbC1pbnN0YWxsLUF6dXJlQURQcmV2aWV3LW1vZHVsZS1vcGVuLVBvd2VyU2hlbGwtYXMtYWRtaW5pc3RyYXRvci5qcGcifQ%3D%3D\">\n\t\t\t\t\t\t\t<img decoding=\"async\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/elementor\/thumbs\/Automating-Azure-AD-Auditing-with-PowerShell-install-AzureADPreview-module-open-PowerShell-as-administrator-qbkopg0oqchgnpkj48zi89wg6bbqgyryahqbv6kfe6.jpg\" title=\"Automating Azure AD Auditing PowerShell: Simplifying Log Analysis\" alt=\"Automating Azure AD Auditing PowerShell: Simplifying Log Analysis\" loading=\"lazy\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-386135b elementor-widget elementor-widget-text-editor\" data-id=\"386135b\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>2. Once PowerShell opens, modify the execution policy to allow PowerShell to run downloaded modules.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-7452f8a ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"7452f8a\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-a8f43c3 ot-flex-column-vertical\" data-id=\"a8f43c3\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-b0af017 elementor-widget elementor-widget-code-highlight\" data-id=\"b0af017\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>powershell.exe -ExecutionPolicy RemoteSigned<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c0a943e elementor-widget elementor-widget-text-editor\" data-id=\"c0a943e\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>3. To install the Azure AD public preview module, run this command. Including the <strong>AllowClobber<\/strong> parameter allows PowerShell to overwrite existing commands as any new command installed.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-5de825c ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"5de825c\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-f963d8c ot-flex-column-vertical\" data-id=\"f963d8c\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-e63a300 elementor-widget elementor-widget-code-highlight\" data-id=\"e63a300\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>Install-module AzureADPreview -Force -AllowClobber<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8b848f9 elementor-widget elementor-widget-text-editor\" data-id=\"8b848f9\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>4. After installing the module, run the import-module command to import the module&#8217;s commands into the current PowerShell session. Perform an optional step that confirms if the module is available in the current session by running the Get-Module command.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-6efd18d ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"6efd18d\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-0d8a37d ot-flex-column-vertical\" data-id=\"0d8a37d\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-b40c7f2 elementor-widget elementor-widget-code-highlight\" data-id=\"b40c7f2\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>Import-Module AzureADPreview\nGet-Module AzureADPreview<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7dbcf86 elementor-widget elementor-widget-text-editor\" data-id=\"7dbcf86\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>This screenshot shows all the commands in this subsection in PowerShell.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-e97cdfc ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"e97cdfc\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-669e2df ot-flex-column-vertical\" data-id=\"669e2df\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-cd915bb elementor-widget elementor-widget-image\" data-id=\"cd915bb\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/This-screenshot-shows-all-the-commands-in-this-subsection-in-PowerShell.-.jpg\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"This screenshot shows all the commands in this subsection in PowerShell.\u00a0\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NTI0MDAsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzA4XC9UaGlzLXNjcmVlbnNob3Qtc2hvd3MtYWxsLXRoZS1jb21tYW5kcy1pbi10aGlzLXN1YnNlY3Rpb24taW4tUG93ZXJTaGVsbC4tLmpwZyJ9\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"344\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/This-screenshot-shows-all-the-commands-in-this-subsection-in-PowerShell.--768x344.jpg\" class=\"attachment-medium_large size-medium_large wp-image-52400\" alt=\"This screenshot shows all the commands in this subsection in PowerShell.\u00a0\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/This-screenshot-shows-all-the-commands-in-this-subsection-in-PowerShell.--768x344.jpg 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/This-screenshot-shows-all-the-commands-in-this-subsection-in-PowerShell.--300x134.jpg 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/This-screenshot-shows-all-the-commands-in-this-subsection-in-PowerShell.--1024x459.jpg 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/This-screenshot-shows-all-the-commands-in-this-subsection-in-PowerShell.--720x323.jpg 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/This-screenshot-shows-all-the-commands-in-this-subsection-in-PowerShell.-.jpg 1366w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-491d1d2 elementor-widget elementor-widget-text-editor\" data-id=\"491d1d2\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Before proceeding with the following subsections, let&#8217;s run the Connect-AzureAD to <a href=\"https:\/\/infrasos.com\/setup-azure-conditional-access-multi-factor-authentication-mfa\/\">authenticate to Azure Active Directory<\/a> and allow us to execute any other command.\u00a0<\/p><p><strong>Replace username@domainname.com with your Azure AD login email.<\/strong><\/p><p>When you run this command, PowerShell displays a sign-in pop-up requesting the password for the Azure AD account. Enter the password and click OK.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-9cea929 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"9cea929\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-0b6d756 ot-flex-column-vertical\" data-id=\"0b6d756\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-0f0e4dd elementor-widget elementor-widget-code-highlight\" data-id=\"0f0e4dd\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>Connect-AzureAD -Credential (Get-Credential username@domainname.com)<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-5c103a1 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"5c103a1\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-d1ea07f ot-flex-column-vertical\" data-id=\"d1ea07f\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-789a76c elementor-widget elementor-widget-image\" data-id=\"789a76c\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Automating-Azure-AD-Auditing-with-PowerShell-authenticate-to-Azure-AD-using-Connect-AzureAD-before-running-Azure-AD-auditing-PowerShell-commands.jpg\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Automating Azure AD Auditing with PowerShell - authenticate to Azure AD using Connect-AzureAD before running Azure AD auditing PowerShell commands\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NTI0MTksInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzA4XC9BdXRvbWF0aW5nLUF6dXJlLUFELUF1ZGl0aW5nLXdpdGgtUG93ZXJTaGVsbC1hdXRoZW50aWNhdGUtdG8tQXp1cmUtQUQtdXNpbmctQ29ubmVjdC1BenVyZUFELWJlZm9yZS1ydW5uaW5nLUF6dXJlLUFELWF1ZGl0aW5nLVBvd2VyU2hlbGwtY29tbWFuZHMuanBnIn0%3D\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"345\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Automating-Azure-AD-Auditing-with-PowerShell-authenticate-to-Azure-AD-using-Connect-AzureAD-before-running-Azure-AD-auditing-PowerShell-commands-768x345.jpg\" class=\"attachment-medium_large size-medium_large wp-image-52419\" alt=\"Automating Azure AD Auditing with PowerShell - authenticate to Azure AD using Connect-AzureAD before running Azure AD auditing PowerShell commands\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Automating-Azure-AD-Auditing-with-PowerShell-authenticate-to-Azure-AD-using-Connect-AzureAD-before-running-Azure-AD-auditing-PowerShell-commands-768x345.jpg 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Automating-Azure-AD-Auditing-with-PowerShell-authenticate-to-Azure-AD-using-Connect-AzureAD-before-running-Azure-AD-auditing-PowerShell-commands-300x135.jpg 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Automating-Azure-AD-Auditing-with-PowerShell-authenticate-to-Azure-AD-using-Connect-AzureAD-before-running-Azure-AD-auditing-PowerShell-commands-1024x460.jpg 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Automating-Azure-AD-Auditing-with-PowerShell-authenticate-to-Azure-AD-using-Connect-AzureAD-before-running-Azure-AD-auditing-PowerShell-commands-720x323.jpg 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Automating-Azure-AD-Auditing-with-PowerShell-authenticate-to-Azure-AD-using-Connect-AzureAD-before-running-Azure-AD-auditing-PowerShell-commands.jpg 1379w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a8ffa04 elementor-widget elementor-widget-text-editor\" data-id=\"a8ffa04\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>If the sign-in is successful, PowerShell displays your Azure tenant information.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-2f6652b ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"2f6652b\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-b3c0dcd ot-flex-column-vertical\" data-id=\"b3c0dcd\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-00204aa elementor-widget elementor-widget-image\" data-id=\"00204aa\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/If-the-sign-in-is-successful-PowerShell-should-display-your-Azure-tenant-information.jpg\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"If the sign-in is successful, PowerShell should display your Azure tenant information\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NTI0MjYsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzA4XC9JZi10aGUtc2lnbi1pbi1pcy1zdWNjZXNzZnVsLVBvd2VyU2hlbGwtc2hvdWxkLWRpc3BsYXkteW91ci1BenVyZS10ZW5hbnQtaW5mb3JtYXRpb24uanBnIn0%3D\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"353\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/If-the-sign-in-is-successful-PowerShell-should-display-your-Azure-tenant-information-768x353.jpg\" class=\"attachment-medium_large size-medium_large wp-image-52426\" alt=\"If the sign-in is successful, PowerShell should display your Azure tenant information\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/If-the-sign-in-is-successful-PowerShell-should-display-your-Azure-tenant-information-768x353.jpg 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/If-the-sign-in-is-successful-PowerShell-should-display-your-Azure-tenant-information-300x138.jpg 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/If-the-sign-in-is-successful-PowerShell-should-display-your-Azure-tenant-information-1024x471.jpg 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/If-the-sign-in-is-successful-PowerShell-should-display-your-Azure-tenant-information-720x331.jpg 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/If-the-sign-in-is-successful-PowerShell-should-display-your-Azure-tenant-information.jpg 1382w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-inner-section elementor-element elementor-element-12d734b8 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default elementor-invisible\" data-id=\"12d734b8\" data-element_type=\"section\" data-settings=\"{&quot;animation&quot;:&quot;bounceInRight&quot;,&quot;background_background&quot;:&quot;gradient&quot;}\">\n\t\t\t\t\t\t\t<div class=\"elementor-background-overlay\"><\/div>\n\t\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-inner-column elementor-element elementor-element-6df4dcf5 ot-flex-column-vertical\" data-id=\"6df4dcf5\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-5b369d30 elementor-widget elementor-widget-heading\" data-id=\"5b369d30\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-large\">Try our Active Directory & Office 365 Reporting & Auditing Tools<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-60174c6e elementor-widget elementor-widget-text-editor\" data-id=\"60174c6e\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p style=\"text-align: center;\"><strong><span style=\"color: #ff6600;\">Try us out<\/span> for <span style=\"color: #ff0000;\">Free<\/span>.\u00a0 100&#8217;s of report templates available. Easily customise your own reports on AD, Azure AD &amp; Office 355.<\/strong><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-inner-column elementor-element elementor-element-1180f68d ot-flex-column-vertical\" data-id=\"1180f68d\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-4784166a elementor-button-align-center elementor-invisible elementor-widget elementor-widget-global elementor-global-5815 elementor-widget-form\" data-id=\"4784166a\" data-element_type=\"widget\" data-settings=\"{&quot;button_width&quot;:&quot;50&quot;,&quot;step_next_label&quot;:&quot;Next&quot;,&quot;step_previous_label&quot;:&quot;Previous&quot;,&quot;_animation&quot;:&quot;pulse&quot;,&quot;step_type&quot;:&quot;none&quot;,&quot;step_icon_shape&quot;:&quot;circle&quot;}\" data-widget_type=\"form.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor-pro - v3.10.3 - 29-01-2023 *\/\n.elementor-button.elementor-hidden,.elementor-hidden{display:none}.e-form__step{width:100%}.e-form__step:not(.elementor-hidden){display:flex;flex-wrap:wrap}.e-form__buttons{flex-wrap:wrap}.e-form__buttons,.e-form__buttons__wrapper{display:flex}.e-form__indicators{display:flex;justify-content:space-between;align-items:center;flex-wrap:nowrap;font-size:13px;margin-bottom:var(--e-form-steps-indicators-spacing)}.e-form__indicators__indicator{display:flex;flex-direction:column;align-items:center;justify-content:center;flex-basis:0;padding:0 var(--e-form-steps-divider-gap)}.e-form__indicators__indicator__progress{width:100%;position:relative;background-color:var(--e-form-steps-indicator-progress-background-color);border-radius:var(--e-form-steps-indicator-progress-border-radius);overflow:hidden}.e-form__indicators__indicator__progress__meter{width:var(--e-form-steps-indicator-progress-meter-width,0);height:var(--e-form-steps-indicator-progress-height);line-height:var(--e-form-steps-indicator-progress-height);padding-right:15px;border-radius:var(--e-form-steps-indicator-progress-border-radius);background-color:var(--e-form-steps-indicator-progress-color);color:var(--e-form-steps-indicator-progress-meter-color);text-align:right;transition:width .1s linear}.e-form__indicators__indicator:first-child{padding-left:0}.e-form__indicators__indicator:last-child{padding-right:0}.e-form__indicators__indicator--state-inactive{color:var(--e-form-steps-indicator-inactive-primary-color,#c2cbd2)}.e-form__indicators__indicator--state-inactive [class*=indicator--shape-]:not(.e-form__indicators__indicator--shape-none){background-color:var(--e-form-steps-indicator-inactive-secondary-color,#fff)}.e-form__indicators__indicator--state-inactive object,.e-form__indicators__indicator--state-inactive svg{fill:var(--e-form-steps-indicator-inactive-primary-color,#c2cbd2)}.e-form__indicators__indicator--state-active{color:var(--e-form-steps-indicator-active-primary-color,#39b54a);border-color:var(--e-form-steps-indicator-active-secondary-color,#fff)}.e-form__indicators__indicator--state-active [class*=indicator--shape-]:not(.e-form__indicators__indicator--shape-none){background-color:var(--e-form-steps-indicator-active-secondary-color,#fff)}.e-form__indicators__indicator--state-active object,.e-form__indicators__indicator--state-active svg{fill:var(--e-form-steps-indicator-active-primary-color,#39b54a)}.e-form__indicators__indicator--state-completed{color:var(--e-form-steps-indicator-completed-secondary-color,#fff)}.e-form__indicators__indicator--state-completed [class*=indicator--shape-]:not(.e-form__indicators__indicator--shape-none){background-color:var(--e-form-steps-indicator-completed-primary-color,#39b54a)}.e-form__indicators__indicator--state-completed .e-form__indicators__indicator__label{color:var(--e-form-steps-indicator-completed-primary-color,#39b54a)}.e-form__indicators__indicator--state-completed .e-form__indicators__indicator--shape-none{color:var(--e-form-steps-indicator-completed-primary-color,#39b54a);background-color:initial}.e-form__indicators__indicator--state-completed object,.e-form__indicators__indicator--state-completed svg{fill:var(--e-form-steps-indicator-completed-secondary-color,#fff)}.e-form__indicators__indicator__icon{width:var(--e-form-steps-indicator-padding,30px);height:var(--e-form-steps-indicator-padding,30px);font-size:var(--e-form-steps-indicator-icon-size);border-width:1px;border-style:solid;display:flex;justify-content:center;align-items:center;overflow:hidden;margin-bottom:10px}.e-form__indicators__indicator__icon img,.e-form__indicators__indicator__icon object,.e-form__indicators__indicator__icon svg{width:var(--e-form-steps-indicator-icon-size);height:auto}.e-form__indicators__indicator__icon .e-font-icon-svg{height:1em}.e-form__indicators__indicator__number{width:var(--e-form-steps-indicator-padding,30px);height:var(--e-form-steps-indicator-padding,30px);border-width:1px;border-style:solid;display:flex;justify-content:center;align-items:center;margin-bottom:10px}.e-form__indicators__indicator--shape-circle{border-radius:50%}.e-form__indicators__indicator--shape-square{border-radius:0}.e-form__indicators__indicator--shape-rounded{border-radius:5px}.e-form__indicators__indicator--shape-none{border:0}.e-form__indicators__indicator__label{text-align:center}.e-form__indicators__indicator__separator{width:100%;height:var(--e-form-steps-divider-width);background-color:#c2cbd2}.e-form__indicators--type-icon,.e-form__indicators--type-icon_text,.e-form__indicators--type-number,.e-form__indicators--type-number_text{align-items:flex-start}.e-form__indicators--type-icon .e-form__indicators__indicator__separator,.e-form__indicators--type-icon_text .e-form__indicators__indicator__separator,.e-form__indicators--type-number .e-form__indicators__indicator__separator,.e-form__indicators--type-number_text .e-form__indicators__indicator__separator{margin-top:calc(var(--e-form-steps-indicator-padding, 30px) \/ 2 - var(--e-form-steps-divider-width, 1px) \/ 2)}.elementor-field-type-hidden{display:none}.elementor-field-type-html{display:inline-block}.elementor-login .elementor-lost-password,.elementor-login .elementor-remember-me{font-size:.85em}.elementor-field-type-recaptcha_v3 .elementor-field-label{display:none}.elementor-field-type-recaptcha_v3 .grecaptcha-badge{z-index:1}.elementor-button .elementor-form-spinner{order:3}.elementor-form .elementor-button>span{display:flex;justify-content:center;align-items:center}.elementor-form .elementor-button .elementor-button-text{white-space:normal;flex-grow:0}.elementor-form .elementor-button svg{height:auto}.elementor-form .elementor-button .e-font-icon-svg{height:1em}.elementor-select-wrapper .select-caret-down-wrapper{position:absolute;top:50%;transform:translateY(-50%);inset-inline-end:10px;pointer-events:none;font-size:11px}.elementor-select-wrapper .select-caret-down-wrapper svg{display:unset;width:1em;aspect-ratio:unset;fill:currentColor}.elementor-select-wrapper .select-caret-down-wrapper i{font-size:19px;line-height:2}.elementor-select-wrapper.remove-before:before{content:\"\"!important}<\/style>\t\t<form class=\"elementor-form\" method=\"post\" name=\"InfraSOS Email Capture\">\n\t\t\t<input type=\"hidden\" name=\"post_id\" value=\"52295\"\/>\n\t\t\t<input type=\"hidden\" name=\"form_id\" value=\"4784166a\"\/>\n\t\t\t<input type=\"hidden\" name=\"referer_title\" value=\"Active Directory Tools, Report, Monitor &amp; Manage AD\" \/>\n\n\t\t\t\n\t\t\t<div class=\"elementor-form-fields-wrapper elementor-labels-above\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-field-type-email elementor-field-group elementor-column elementor-field-group-email elementor-col-50 elementor-field-required\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<input size=\"1\" type=\"email\" name=\"form_fields[email]\" id=\"form-field-email\" class=\"elementor-field elementor-size-lg  elementor-field-textual\" placeholder=\"Enter your email address\" required=\"required\" aria-required=\"true\">\n\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<div class=\"elementor-field-group elementor-column elementor-field-type-submit elementor-col-50 e-form__buttons\">\n\t\t\t\t\t<button type=\"submit\" class=\"elementor-button elementor-size-lg\">\n\t\t\t\t\t\t<span >\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\" elementor-button-icon\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-button-text\">Try InfraSOS FREE<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/button>\n\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t<\/form>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t<div class=\"elementor-element elementor-element-f780418 e-con-boxed e-con\" data-id=\"f780418\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-ad1724f elementor-widget elementor-widget-text-editor\" data-id=\"ad1724f\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read<\/strong><\/span>\u00a0<a href=\"https:\/\/infrasos.com\/office-365-reporting\/\">Try InfraSOS Office 365 Reporting &amp; Auditing Platform<\/a><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-7f32447 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"7f32447\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-1685328 ot-flex-column-vertical\" data-id=\"1685328\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-591df34 elementor-widget elementor-widget-heading\" data-id=\"591df34\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-large\">Analyse Azure AD Audit Logs with PowerShell<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-619241d elementor-widget elementor-widget-text-editor\" data-id=\"619241d\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>The <a href=\"https:\/\/learn.microsoft.com\/en-us\/powershell\/module\/azuread\/get-azureadauditdirectorylogs?view=azureadps-2.0-preview\" target=\"_blank\" rel=\"noopener\">Get-AzureADAuditDirectoryLogs<\/a> command is used to report Azure AD audit logs. Running this command without any parameters returns too much information.<\/p><p>To reduce the amount of information, we utilise the <strong>Top<\/strong> and\u00a0<strong>Filter<\/strong> parameters. The Top parameter allows you to specify the number of records to return.\u00a0<\/p><p>This command displays the last three records in the Azure Active Directory audit log.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-3870f75 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"3870f75\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-39cbd9c ot-flex-column-vertical\" data-id=\"39cbd9c\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-e01313b elementor-widget elementor-widget-code-highlight\" data-id=\"e01313b\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>Get-AzureADAuditDirectoryLogs -Top 3<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-361648f elementor-widget elementor-widget-text-editor\" data-id=\"361648f\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Here is the result. As you see, this report lists the results, which is not very useful.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-6c2534f ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"6c2534f\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-16245c4 ot-flex-column-vertical\" data-id=\"16245c4\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-5f1f3ab elementor-widget elementor-widget-image\" data-id=\"5f1f3ab\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Automating-Azure-AD-Auditing-with-PowerShell-return-top-three-audit-report-with-Get-AzureADAuditDirectoryLogs-Top-3.jpg\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Automating Azure AD Auditing with PowerShell - return top three audit report with Get-AzureADAuditDirectoryLogs -Top 3\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NTI0NTEsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzA4XC9BdXRvbWF0aW5nLUF6dXJlLUFELUF1ZGl0aW5nLXdpdGgtUG93ZXJTaGVsbC1yZXR1cm4tdG9wLXRocmVlLWF1ZGl0LXJlcG9ydC13aXRoLUdldC1BenVyZUFEQXVkaXREaXJlY3RvcnlMb2dzLVRvcC0zLmpwZyJ9\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"392\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Automating-Azure-AD-Auditing-with-PowerShell-return-top-three-audit-report-with-Get-AzureADAuditDirectoryLogs-Top-3-768x392.jpg\" class=\"attachment-medium_large size-medium_large wp-image-52451\" alt=\"Automating Azure AD Auditing with PowerShell - return top three audit report with Get-AzureADAuditDirectoryLogs -Top 3\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Automating-Azure-AD-Auditing-with-PowerShell-return-top-three-audit-report-with-Get-AzureADAuditDirectoryLogs-Top-3-768x392.jpg 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Automating-Azure-AD-Auditing-with-PowerShell-return-top-three-audit-report-with-Get-AzureADAuditDirectoryLogs-Top-3-300x153.jpg 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Automating-Azure-AD-Auditing-with-PowerShell-return-top-three-audit-report-with-Get-AzureADAuditDirectoryLogs-Top-3-1024x523.jpg 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Automating-Azure-AD-Auditing-with-PowerShell-return-top-three-audit-report-with-Get-AzureADAuditDirectoryLogs-Top-3-720x368.jpg 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Automating-Azure-AD-Auditing-with-PowerShell-return-top-three-audit-report-with-Get-AzureADAuditDirectoryLogs-Top-3.jpg 1405w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-49fa880 elementor-widget elementor-widget-text-editor\" data-id=\"49fa880\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>To display the result in a table, we pipe Get-AzureADAuditDirectoryLogs to Format-Table.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-651edb9 elementor-widget elementor-widget-code-highlight\" data-id=\"651edb9\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>Get-AzureADAuditDirectoryLogs -Top 3 | Format-Table<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5e4229e elementor-widget elementor-widget-text-editor\" data-id=\"5e4229e\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>With this last modification, the report is displayed in a table!<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-00f38db ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"00f38db\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-e7485b7 ot-flex-column-vertical\" data-id=\"e7485b7\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-04c321d elementor-widget elementor-widget-image\" data-id=\"04c321d\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Automating-Azure-AD-Auditing-with-PowerShell-pipe-Get-AzureADAuditDirectoryLogs-Top-3-to-Format-Table.jpg\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Automating Azure AD Auditing with PowerShell - pipe Get-AzureADAuditDirectoryLogs -Top 3 to Format-Table\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NTI0NTgsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzA4XC9BdXRvbWF0aW5nLUF6dXJlLUFELUF1ZGl0aW5nLXdpdGgtUG93ZXJTaGVsbC1waXBlLUdldC1BenVyZUFEQXVkaXREaXJlY3RvcnlMb2dzLVRvcC0zLXRvLUZvcm1hdC1UYWJsZS5qcGcifQ%3D%3D\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"295\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Automating-Azure-AD-Auditing-with-PowerShell-pipe-Get-AzureADAuditDirectoryLogs-Top-3-to-Format-Table-768x295.jpg\" class=\"attachment-medium_large size-medium_large wp-image-52458\" alt=\"Automating Azure AD Auditing with PowerShell - pipe Get-AzureADAuditDirectoryLogs -Top 3 to Format-Table\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Automating-Azure-AD-Auditing-with-PowerShell-pipe-Get-AzureADAuditDirectoryLogs-Top-3-to-Format-Table-768x295.jpg 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Automating-Azure-AD-Auditing-with-PowerShell-pipe-Get-AzureADAuditDirectoryLogs-Top-3-to-Format-Table-300x115.jpg 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Automating-Azure-AD-Auditing-with-PowerShell-pipe-Get-AzureADAuditDirectoryLogs-Top-3-to-Format-Table-1024x393.jpg 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Automating-Azure-AD-Auditing-with-PowerShell-pipe-Get-AzureADAuditDirectoryLogs-Top-3-to-Format-Table-720x276.jpg 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Automating-Azure-AD-Auditing-with-PowerShell-pipe-Get-AzureADAuditDirectoryLogs-Top-3-to-Format-Table.jpg 1371w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-fad6ece elementor-widget elementor-widget-text-editor\" data-id=\"fad6ece\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Although the\u00a0<strong>Top<\/strong> parameter is great, the most useful parameter is <strong>Filter<\/strong>. This parameter allows you to return specific results from the Azure AD audit logs.\u00a0<\/p><p>For example, to return all audit logs about an object with a display name, &#8216;WordPress Site (Azure CLI)&#8217; I execute this command:<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-d5ce639 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"d5ce639\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-f62b6cf ot-flex-column-vertical\" data-id=\"f62b6cf\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-743a34a elementor-widget elementor-widget-code-highlight\" data-id=\"743a34a\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>Get-AzureADAuditDirectoryLogs -Filter \"targetResources\/any(tr:tr\/displayName eq 'WordPress Site (Azure CLI)')\"<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-c9f9db8 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"c9f9db8\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-fd06d54 ot-flex-column-vertical\" data-id=\"fd06d54\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-486c0b9 elementor-widget elementor-widget-image\" data-id=\"486c0b9\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Get-AzureADAuditDirectoryLogs-with-the-Filter-parameter-filter-by-target-resource-displayname.jpg\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Get-AzureADAuditDirectoryLogs with the Filter parameter - filter by target resource displayname\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NTI0OTUsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzA4XC9HZXQtQXp1cmVBREF1ZGl0RGlyZWN0b3J5TG9ncy13aXRoLXRoZS1GaWx0ZXItcGFyYW1ldGVyLWZpbHRlci1ieS10YXJnZXQtcmVzb3VyY2UtZGlzcGxheW5hbWUuanBnIn0%3D\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"410\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Get-AzureADAuditDirectoryLogs-with-the-Filter-parameter-filter-by-target-resource-displayname-768x410.jpg\" class=\"attachment-medium_large size-medium_large wp-image-52495\" alt=\"Get-AzureADAuditDirectoryLogs with the Filter parameter - filter by target resource displayname\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Get-AzureADAuditDirectoryLogs-with-the-Filter-parameter-filter-by-target-resource-displayname-768x410.jpg 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Get-AzureADAuditDirectoryLogs-with-the-Filter-parameter-filter-by-target-resource-displayname-300x160.jpg 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Get-AzureADAuditDirectoryLogs-with-the-Filter-parameter-filter-by-target-resource-displayname-1024x547.jpg 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Get-AzureADAuditDirectoryLogs-with-the-Filter-parameter-filter-by-target-resource-displayname-720x385.jpg 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Get-AzureADAuditDirectoryLogs-with-the-Filter-parameter-filter-by-target-resource-displayname.jpg 1481w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8000058 elementor-widget elementor-widget-text-editor\" data-id=\"8000058\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Beyond filtering results by target resource, we could use other filtering methods. For instance, filter by the status of the action: Success or failure.\u00a0<\/p><p>The command below returns the last three failure actions recorded in the audit log.\u00a0\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-d6004e8 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"d6004e8\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-b9ffeb5 ot-flex-column-vertical\" data-id=\"b9ffeb5\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-b9a27e5 elementor-widget elementor-widget-code-highlight\" data-id=\"b9a27e5\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>Get-AzureADAuditDirectoryLogs -Filter \"result eq 'failure'\" -Top 3 | Format-Table<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-433426f elementor-widget elementor-widget-text-editor\" data-id=\"433426f\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>And here is the result.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-b1bddbf ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"b1bddbf\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-4c3a4d7 ot-flex-column-vertical\" data-id=\"4c3a4d7\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-debbf24 elementor-widget elementor-widget-image\" data-id=\"debbf24\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Beyond-filtering-results-by-target-resource-we-could-use-other-filtering-methods-For-instance-I-could-filter-by-the-status-of-the-action-Success-or-failure.-.jpg\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Beyond filtering results by target resource, we could use other filtering methods - For instance, I could filter by the status of the action - Success or failure.\u00a0\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6IjUyNTExIiwidXJsIjoiaHR0cHM6XC9cL2luZnJhc29zLmNvbVwvd3AtY29udGVudFwvdXBsb2Fkc1wvMjAyM1wvMDhcL0JleW9uZC1maWx0ZXJpbmctcmVzdWx0cy1ieS10YXJnZXQtcmVzb3VyY2Utd2UtY291bGQtdXNlLW90aGVyLWZpbHRlcmluZy1tZXRob2RzLUZvci1pbnN0YW5jZS1JLWNvdWxkLWZpbHRlci1ieS10aGUtc3RhdHVzLW9mLXRoZS1hY3Rpb24tU3VjY2Vzcy1vci1mYWlsdXJlLi0uanBnIn0%3D\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"261\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Beyond-filtering-results-by-target-resource-we-could-use-other-filtering-methods-For-instance-I-could-filter-by-the-status-of-the-action-Success-or-failure.--768x261.jpg\" class=\"attachment-medium_large size-medium_large wp-image-52511\" alt=\"Beyond filtering results by target resource, we could use other filtering methods - For instance, I could filter by the status of the action - Success or failure.\u00a0\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Beyond-filtering-results-by-target-resource-we-could-use-other-filtering-methods-For-instance-I-could-filter-by-the-status-of-the-action-Success-or-failure.--768x261.jpg 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Beyond-filtering-results-by-target-resource-we-could-use-other-filtering-methods-For-instance-I-could-filter-by-the-status-of-the-action-Success-or-failure.--300x102.jpg 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Beyond-filtering-results-by-target-resource-we-could-use-other-filtering-methods-For-instance-I-could-filter-by-the-status-of-the-action-Success-or-failure.--1024x348.jpg 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Beyond-filtering-results-by-target-resource-we-could-use-other-filtering-methods-For-instance-I-could-filter-by-the-status-of-the-action-Success-or-failure.--720x245.jpg 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Beyond-filtering-results-by-target-resource-we-could-use-other-filtering-methods-For-instance-I-could-filter-by-the-status-of-the-action-Success-or-failure.-.jpg 1515w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e4e4be4 elementor-widget elementor-widget-text-editor\" data-id=\"e4e4be4\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Finally, for this subsection, you could filter by the person who initiated the activity recoded in the <a href=\"https:\/\/infrasos.com\/azure-ad-monitoring\/\">Azure AD audit log<\/a>. To illustrate, run this command to return all activities initiated by a user with UPN, name@DomainName.com.<\/p><p>To run this command, change name@DomainName.com to a real UPN.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-e9ae173 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"e9ae173\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-1db44fb ot-flex-column-vertical\" data-id=\"1db44fb\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-3b7fd0a elementor-widget elementor-widget-code-highlight\" data-id=\"3b7fd0a\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>Get-AzureADAuditDirectoryLogs -Filter \"initiatedBy\/user\/userPrincipalName eq 'name@DomainName.com'\"<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0866e37 elementor-widget elementor-widget-text-editor\" data-id=\"0866e37\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Here is the result in my Azure AD that returns all activities for a real user.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-1128044 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"1128044\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-040b3c9 ot-flex-column-vertical\" data-id=\"040b3c9\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-fe5df61 elementor-widget elementor-widget-image\" data-id=\"fe5df61\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Automating-Azure-AD-Auditing-with-PowerShell-Get-AzureADAuditDirectoryLogs-filter-by-the-UPN-that-initiated-the-activity.jpg\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Automating Azure AD Auditing with PowerShell - Get-AzureADAuditDirectoryLogs filter by the UPN that initiated the activity\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NTI1MTgsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzA4XC9BdXRvbWF0aW5nLUF6dXJlLUFELUF1ZGl0aW5nLXdpdGgtUG93ZXJTaGVsbC1HZXQtQXp1cmVBREF1ZGl0RGlyZWN0b3J5TG9ncy1maWx0ZXItYnktdGhlLVVQTi10aGF0LWluaXRpYXRlZC10aGUtYWN0aXZpdHkuanBnIn0%3D\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"281\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Automating-Azure-AD-Auditing-with-PowerShell-Get-AzureADAuditDirectoryLogs-filter-by-the-UPN-that-initiated-the-activity-768x281.jpg\" class=\"attachment-medium_large size-medium_large wp-image-52518\" alt=\"Automating Azure AD Auditing with PowerShell - Get-AzureADAuditDirectoryLogs filter by the UPN that initiated the activity\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Automating-Azure-AD-Auditing-with-PowerShell-Get-AzureADAuditDirectoryLogs-filter-by-the-UPN-that-initiated-the-activity-768x281.jpg 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Automating-Azure-AD-Auditing-with-PowerShell-Get-AzureADAuditDirectoryLogs-filter-by-the-UPN-that-initiated-the-activity-300x110.jpg 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Automating-Azure-AD-Auditing-with-PowerShell-Get-AzureADAuditDirectoryLogs-filter-by-the-UPN-that-initiated-the-activity-1024x374.jpg 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Automating-Azure-AD-Auditing-with-PowerShell-Get-AzureADAuditDirectoryLogs-filter-by-the-UPN-that-initiated-the-activity-720x263.jpg 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Automating-Azure-AD-Auditing-with-PowerShell-Get-AzureADAuditDirectoryLogs-filter-by-the-UPN-that-initiated-the-activity.jpg 1485w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t<div class=\"elementor-element elementor-element-fa0206f e-con-boxed e-con\" data-id=\"fa0206f\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-95c4c86 elementor-widget elementor-widget-text-editor\" data-id=\"95c4c86\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/azure-ad-monitoring\/\">Try InfraSOS Azure AD Reporting &amp; Auditing Tool<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-fdbee85 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"fdbee85\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-34d384c ot-flex-column-vertical\" data-id=\"34d384c\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-50d3505 elementor-widget elementor-widget-heading\" data-id=\"50d3505\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-large\">Analyse Azure AD Sign-in Logs with PowerShell<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-bd97fe8 elementor-widget elementor-widget-text-editor\" data-id=\"bd97fe8\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>The Azure AD <a href=\"https:\/\/infrasos.com\/office-365-reporting\/office-365-user-reports\/\">sign-in log report<\/a> is run using the <a href=\"https:\/\/infrasos.com\/get-azureadauditsigninlogs-find-sign-in-logs-for-last-30-days-with-powershell\/\" rel=\"noopener\">Get-AzureADAuditSignInLogs<\/a> command. This <a href=\"https:\/\/learn.microsoft.com\/en-us\/powershell\/module\/azuread\/?view=azureadps-2.0-preview\" target=\"_blank\" rel=\"noopener\" data-linktype=\"relative-path\">AzureADPreview<\/a> PowerShell command has the same parameters as the Get-AzureADAuditDirectoryLogs command.\u00a0<\/p><p>Let&#8217;s start by running a command that returns the sign-in log report for a specific user.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-992edca ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"992edca\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-3c1c727 ot-flex-column-vertical\" data-id=\"3c1c727\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-b3c6e15 elementor-widget elementor-widget-code-highlight\" data-id=\"b3c6e15\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>Get-AzureADAuditSignInLogs -Filter \"userDisplayName eq 'Victor Ashiedu'\"<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ec4b4dc elementor-widget elementor-widget-text-editor\" data-id=\"ec4b4dc\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Since the above command returned too many results, I modify the command to display the last 3.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-50c7b47 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"50c7b47\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-97da205 ot-flex-column-vertical\" data-id=\"97da205\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-678401b elementor-widget elementor-widget-code-highlight\" data-id=\"678401b\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>Get-AzureADAuditSignInLogs -Filter \"userDisplayName eq 'Victor Ashiedu'\" -Top 3 | Format-Table<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ef35c55 elementor-widget elementor-widget-text-editor\" data-id=\"ef35c55\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>The last command displays less information allowing for better analysis of the sign-in logs.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-d1a2c60 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"d1a2c60\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-9c0826e ot-flex-column-vertical\" data-id=\"9c0826e\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-30fa51a elementor-widget elementor-widget-image\" data-id=\"30fa51a\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Filter-Get-AzureADAuditSignInLogs-by-users-display-name-and-return-the-top-3-results.jpg\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Filter Get-AzureADAuditSignInLogs by user&#039;s display name and return the top 3 results\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NTI1NDMsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzA4XC9GaWx0ZXItR2V0LUF6dXJlQURBdWRpdFNpZ25JbkxvZ3MtYnktdXNlcnMtZGlzcGxheS1uYW1lLWFuZC1yZXR1cm4tdGhlLXRvcC0zLXJlc3VsdHMuanBnIn0%3D\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"275\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Filter-Get-AzureADAuditSignInLogs-by-users-display-name-and-return-the-top-3-results-768x275.jpg\" class=\"attachment-medium_large size-medium_large wp-image-52543\" alt=\"Filter Get-AzureADAuditSignInLogs by user&#039;s display name and return the top 3 results\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Filter-Get-AzureADAuditSignInLogs-by-users-display-name-and-return-the-top-3-results-768x275.jpg 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Filter-Get-AzureADAuditSignInLogs-by-users-display-name-and-return-the-top-3-results-300x108.jpg 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Filter-Get-AzureADAuditSignInLogs-by-users-display-name-and-return-the-top-3-results-1024x367.jpg 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Filter-Get-AzureADAuditSignInLogs-by-users-display-name-and-return-the-top-3-results-720x258.jpg 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Filter-Get-AzureADAuditSignInLogs-by-users-display-name-and-return-the-top-3-results.jpg 1481w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5fbc266 elementor-widget elementor-widget-text-editor\" data-id=\"5fbc266\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>I can also combine 2 filtering operations &#8211; user display name and date to display specific Azure AD sign-in logs. Here is an example that returns all sign-in logs recorded on 2023-08-28 for a user with the display name &#8216;Victor Ashiedu.&#8217;<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-8962ed5 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"8962ed5\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-2bd17e3 ot-flex-column-vertical\" data-id=\"2bd17e3\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-8321ed4 elementor-widget elementor-widget-code-highlight\" data-id=\"8321ed4\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>Get-AzureADAuditSignInLogs -Filter \"(userDisplayName eq 'Victor Ashiedu') and (createdDateTime gt 2023-08-28)\" | Format-Table<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t<div class=\"elementor-element elementor-element-d9c4055 e-con-boxed e-con\" data-id=\"d9c4055\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-6f19899 elementor-widget elementor-widget-text-editor\" data-id=\"6f19899\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/azure-ad-monitoring\/azure-ad-guest-reports-auditing-tool\/\">Find out our InfraSOS Azure AD Guest Reports &amp; Auditing Tool<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-6b9835d ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"6b9835d\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-6334efe ot-flex-column-vertical\" data-id=\"6334efe\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-af39241 elementor-widget elementor-widget-heading\" data-id=\"af39241\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-large\">Automating Azure AD Auditing with PowerShell: Configuring Audit Log Retention<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c70aab2 elementor-widget elementor-widget-text-editor\" data-id=\"c70aab2\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Azure Active Directory audit logs are retained for <a href=\"https:\/\/learn.microsoft.com\/en-us\/purview\/audit-log-retention-policies#default-retention-policy-record-types\" target=\"_blank\" rel=\"noopener\">12 months<\/a> by default. However,\u00a0 modify the default log retention period by creating a custom audit log retention policy.\u00a0<\/p><p>In the following subsections, we explore how to create, view, edit, and delete Azure AD Audit log retention policies using Windows PowerShell scripts.<\/p><p>The commands required for this section are part of the <a href=\"https:\/\/infrasos.com\/how-to-connect-to-exchange-online-using-powershell\/\">ExchangeOnlineManagement\u00a0<\/a>module. So, in the first subsection below, weinstall this module.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-6df98b3 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"6df98b3\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-d26f228 ot-flex-column-vertical\" data-id=\"d26f228\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-efeaf2c elementor-widget elementor-widget-heading\" data-id=\"efeaf2c\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-large\">Install the ExchangePowerShell PowerShell Module<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ce02d23 elementor-widget elementor-widget-text-editor\" data-id=\"ce02d23\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>1. Follow the steps we described for opening PowerShell as administrator and modifying the execution policy in the first section. After that, run the command below to install the ExchangePowerShell module.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-5a77cdc ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"5a77cdc\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-8f585a3 ot-flex-column-vertical\" data-id=\"8f585a3\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-3b0e048 elementor-widget elementor-widget-code-highlight\" data-id=\"3b0e048\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>Install-Module -Name ExchangeOnlineManagement -AllowClobber -Force<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-314ab63 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"314ab63\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-35cad3f ot-flex-column-vertical\" data-id=\"35cad3f\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-5e1bad9 elementor-widget elementor-widget-text-editor\" data-id=\"5e1bad9\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>2. Once the command runs successfully, use the Import-Module command to import the module to your PowerShell session. Additionally, you may execute the Get-Module command to confirm that the module is available on your PC.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-260b472 elementor-widget elementor-widget-code-highlight\" data-id=\"260b472\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>Import-Module ExchangeOnlineManagement\nGet-Module ExchangeOnlineManagement<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ab0be98 elementor-widget elementor-widget-text-editor\" data-id=\"ab0be98\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>3. Next, run the Connect-ExchangeOnline to authenticate to Exchange Online. After that, run the <a href=\"https:\/\/learn.microsoft.com\/en-us\/powershell\/module\/exchange\/connect-ippssession\" target=\"_blank\" rel=\"noopener\" data-linktype=\"absolute-path\">Connect-IPPSSession<\/a> commands to Connect to Security &amp; Compliance PowerShell. Change name@domainname.com to your Azure AD UPN.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-1741869 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"1741869\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-bddc580 ot-flex-column-vertical\" data-id=\"bddc580\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-f782cf9 elementor-widget elementor-widget-code-highlight\" data-id=\"f782cf9\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>Connect-ExchangeOnline -Credential (Get-Credential name@domainname.com)\nConnect-IPPSSession -UserPrincipalName name@domainname.com<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-276c8e3 elementor-widget elementor-widget-heading\" data-id=\"276c8e3\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-large\">Create and Modify Azure AD Audit Log Retention using PowerShell<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e17ed85 elementor-widget elementor-widget-text-editor\" data-id=\"e17ed85\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Once you&#8217;ve connected successfully, create a new audit log retention policy with this command.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-fc275f3 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"fc275f3\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-f646f7d ot-flex-column-vertical\" data-id=\"f646f7d\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-42b9542 elementor-widget elementor-widget-code-highlight\" data-id=\"42b9542\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>New-UnifiedAuditLogRetentionPolicy -Name \"Microsoft AzureAD Audit Policy\" -Description \"One-year retention policy for all Azure AD activities\" -RecordTypes AzureActiveDirectory -RetentionDuration TwelveMonths -Priority 99<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3b43f4f elementor-widget elementor-widget-text-editor\" data-id=\"3b43f4f\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>The command creates a new one-year AzureAD audit retention policy with a priority of 99.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-86ee210 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"86ee210\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-6146190 ot-flex-column-vertical\" data-id=\"6146190\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-4160b0d elementor-widget elementor-widget-image\" data-id=\"4160b0d\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Create-Azure-AD-Audit-Log-Retention-using-PowerShell.jpg\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Create Azure AD Audit Log Retention using PowerShell\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NTI2NjYsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzA4XC9DcmVhdGUtQXp1cmUtQUQtQXVkaXQtTG9nLVJldGVudGlvbi11c2luZy1Qb3dlclNoZWxsLmpwZyJ9\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"396\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Create-Azure-AD-Audit-Log-Retention-using-PowerShell-768x396.jpg\" class=\"attachment-medium_large size-medium_large wp-image-52666\" alt=\"Create Azure AD Audit Log Retention using PowerShell\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Create-Azure-AD-Audit-Log-Retention-using-PowerShell-768x396.jpg 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Create-Azure-AD-Audit-Log-Retention-using-PowerShell-300x155.jpg 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Create-Azure-AD-Audit-Log-Retention-using-PowerShell-1024x528.jpg 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Create-Azure-AD-Audit-Log-Retention-using-PowerShell-720x372.jpg 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Create-Azure-AD-Audit-Log-Retention-using-PowerShell.jpg 1525w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2304872 elementor-widget elementor-widget-text-editor\" data-id=\"2304872\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>The New-UnifiedAuditLogRetentionPolicy command allows you to specify the type of audit log retention using the RecordTypes parameter. Get the names of the retention record types from the <a href=\"https:\/\/learn.microsoft.com\/en-us\/office\/office-365-management-api\/office-365-management-activity-api-schema#auditlogrecordtype\" target=\"_blank\" rel=\"noopener\">RecordTypes<\/a> link.\u00a0<\/p><p>As I mentioned earlier, my last command created an audit log policy for Azure Active Directory logs, with RecordTypes specified as AzureActiveDirectory. If I wanted the audit log retention policy to apply to SharePoint events, I would have included SharePoint in the RecordTypes list.<\/p><p>To modify this audit log retention policy to include this record type, I&#8217;ll run the command below.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-f007982 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"f007982\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-62a96a1 ot-flex-column-vertical\" data-id=\"62a96a1\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-dbae4e8 elementor-widget elementor-widget-code-highlight\" data-id=\"dbae4e8\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>Get-UnifiedAuditLogRetentionPolicy | ForEach-Object { Set-UnifiedAuditLogRetentionPolicy -Identity $_ -Priority 101 -RetentionDuration TwelveMonths -RecordTypes AzureActiveDirectory, SharePoint }<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t<div class=\"elementor-element elementor-element-8fa915b e-con-boxed e-con\" data-id=\"8fa915b\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-be0767c elementor-widget elementor-widget-text-editor\" data-id=\"be0767c\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/check-azure-ad-audit-logs-for-user-sign-ins-success-and-failures\/\">Check Azure AD Audit Logs for User Sign-Ins (Success Failures)<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-b99362e ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"b99362e\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-92ca316 ot-flex-column-vertical\" data-id=\"92ca316\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-f360d8c elementor-widget elementor-widget-heading\" data-id=\"f360d8c\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-large\">View Azure AD Audit Log Retention Policies using PowerShell<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-eee946a elementor-widget elementor-widget-text-editor\" data-id=\"eee946a\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>To display all azure AD audit logs, run this command.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-198fd74 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"198fd74\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-bbc80c9 ot-flex-column-vertical\" data-id=\"bbc80c9\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-78282ed elementor-widget elementor-widget-code-highlight\" data-id=\"78282ed\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>Get-UnifiedAuditLogRetentionPolicy -RecordType AzureActiveDirectory<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-473b9e4 elementor-widget elementor-widget-text-editor\" data-id=\"473b9e4\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>The command returns all Azure Active Directory retention policies. However, we filter the report using the Where-Object command. Here is a sample command that returns the retention policy, &#8220;Microsoft AzureAD AuditPolicy.&#8221;<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-d8c90fa ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"d8c90fa\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-84053a3 ot-flex-column-vertical\" data-id=\"84053a3\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-7342473 elementor-widget elementor-widget-code-highlight\" data-id=\"7342473\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>Get-UnifiedAuditLogRetentionPolicy | Where-Object Name -eq \"Microsoft AzureAD AuditPolicy\"<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-90ccb3b elementor-widget elementor-widget-text-editor\" data-id=\"90ccb3b\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Finally, the result is displayed in a table by piping the last result to Format-Table.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-f4b2295 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"f4b2295\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-daae3d7 ot-flex-column-vertical\" data-id=\"daae3d7\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-e66e7dc elementor-widget elementor-widget-code-highlight\" data-id=\"e66e7dc\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>Get-UnifiedAuditLogRetentionPolicy | Where-Object Name -eq \"Microsoft AzureAD AuditPolicy\" | Format-Table<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-c7c5530 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"c7c5530\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-bdc5fc6 ot-flex-column-vertical\" data-id=\"bdc5fc6\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-8e6ae15 elementor-widget elementor-widget-heading\" data-id=\"8e6ae15\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-large\"> Delete Azure AD Audit Log Retention Policies using PowerShell<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c8a7644 elementor-widget elementor-widget-text-editor\" data-id=\"c8a7644\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>To delete an Azure AD audit retention policy, pipe the output of Get-UnifiedAuditLogRetentionPolicy to Remove-UnifiedAuditLogRetentionPolicy. For instance, the command below deletes the audit retention policy I created earlier.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-631a6f1 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"631a6f1\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-0f30134 ot-flex-column-vertical\" data-id=\"0f30134\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-09a0cb3 elementor-widget elementor-widget-code-highlight\" data-id=\"09a0cb3\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>Get-UnifiedAuditLogRetentionPolicy | Where-Object Name -eq \"Microsoft AzureAD AuditPolicy\" | Remove-UnifiedAuditLogRetentionPolicy<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-64ed3bd elementor-widget elementor-widget-text-editor\" data-id=\"64ed3bd\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>By running the command without including the <strong>Force<\/strong> parameter, PowerShell prompts for confirmation.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-c913d99 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"c913d99\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-dcce06e ot-flex-column-vertical\" data-id=\"dcce06e\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-690f44a elementor-widget elementor-widget-image\" data-id=\"690f44a\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Automating-Azure-AD-Auditing-with-PowerShell-Delete-Azure-AD-Audit-Log-Retention-Policies-using-PowerShell.jpg\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Automating Azure AD Auditing with PowerShell - Delete Azure AD Audit Log Retention Policies using PowerShell\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NTI3ODAsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzA4XC9BdXRvbWF0aW5nLUF6dXJlLUFELUF1ZGl0aW5nLXdpdGgtUG93ZXJTaGVsbC1EZWxldGUtQXp1cmUtQUQtQXVkaXQtTG9nLVJldGVudGlvbi1Qb2xpY2llcy11c2luZy1Qb3dlclNoZWxsLmpwZyJ9\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"309\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Automating-Azure-AD-Auditing-with-PowerShell-Delete-Azure-AD-Audit-Log-Retention-Policies-using-PowerShell-768x309.jpg\" class=\"attachment-medium_large size-medium_large wp-image-52780\" alt=\"Automating Azure AD Auditing with PowerShell - Delete Azure AD Audit Log Retention Policies using PowerShell\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Automating-Azure-AD-Auditing-with-PowerShell-Delete-Azure-AD-Audit-Log-Retention-Policies-using-PowerShell-768x309.jpg 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Automating-Azure-AD-Auditing-with-PowerShell-Delete-Azure-AD-Audit-Log-Retention-Policies-using-PowerShell-300x121.jpg 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Automating-Azure-AD-Auditing-with-PowerShell-Delete-Azure-AD-Audit-Log-Retention-Policies-using-PowerShell-1024x412.jpg 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Automating-Azure-AD-Auditing-with-PowerShell-Delete-Azure-AD-Audit-Log-Retention-Policies-using-PowerShell-1536x618.jpg 1536w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Automating-Azure-AD-Auditing-with-PowerShell-Delete-Azure-AD-Audit-Log-Retention-Policies-using-PowerShell-720x289.jpg 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Automating-Azure-AD-Auditing-with-PowerShell-Delete-Azure-AD-Audit-Log-Retention-Policies-using-PowerShell.jpg 1552w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-308397b elementor-widget elementor-widget-text-editor\" data-id=\"308397b\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>To avoid this prompt, include the\u00a0<strong>Force<\/strong> parameter.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-e6adf0f ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"e6adf0f\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-79eaac7 ot-flex-column-vertical\" data-id=\"79eaac7\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-bf88021 elementor-widget elementor-widget-code-highlight\" data-id=\"bf88021\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>Get-UnifiedAuditLogRetentionPolicy | Where-Object Name -eq \"Microsoft AzureAD AuditPolicy\" | Remove-UnifiedAuditLogRetentionPolicy -ForceDeletion<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6d9ca09 elementor-widget elementor-widget-text-editor\" data-id=\"6d9ca09\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Unfortunately, trying to force deletion returns an error that states that the policy cannot be force deleted since it is not in a &#8220;pending deletion state.&#8221; So, the only option is to respond to the prompt to confirm the deletion.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-1bd51dc ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"1bd51dc\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-b5865be ot-flex-column-vertical\" data-id=\"b5865be\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-3022bd7 elementor-widget elementor-widget-image\" data-id=\"3022bd7\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Delete-Azure-AD-Audit-Log-Retention-Policies-using-PowerShell.jpg\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Delete Azure AD Audit Log Retention Policies using PowerShell\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6IjUyNzg3IiwidXJsIjoiaHR0cHM6XC9cL2luZnJhc29zLmNvbVwvd3AtY29udGVudFwvdXBsb2Fkc1wvMjAyM1wvMDhcL0RlbGV0ZS1BenVyZS1BRC1BdWRpdC1Mb2ctUmV0ZW50aW9uLVBvbGljaWVzLXVzaW5nLVBvd2VyU2hlbGwuanBnIn0%3D\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"355\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Delete-Azure-AD-Audit-Log-Retention-Policies-using-PowerShell-768x355.jpg\" class=\"attachment-medium_large size-medium_large wp-image-52787\" alt=\"Delete Azure AD Audit Log Retention Policies using PowerShell\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Delete-Azure-AD-Audit-Log-Retention-Policies-using-PowerShell-768x355.jpg 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Delete-Azure-AD-Audit-Log-Retention-Policies-using-PowerShell-300x139.jpg 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Delete-Azure-AD-Audit-Log-Retention-Policies-using-PowerShell-1024x473.jpg 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Delete-Azure-AD-Audit-Log-Retention-Policies-using-PowerShell-720x333.jpg 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/08\/Delete-Azure-AD-Audit-Log-Retention-Policies-using-PowerShell.jpg 1344w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t<div class=\"elementor-element elementor-element-0a22265 e-con-boxed e-con\" data-id=\"0a22265\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-64864a5 elementor-widget elementor-widget-text-editor\" data-id=\"64864a5\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/azure-ad-auditing-enabling-and-configuring-audit-logs\/\">Azure AD Auditing: Enabling and Configuring Audit Logs<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-544f07a ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"544f07a\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-f1d131b ot-flex-column-vertical\" data-id=\"f1d131b\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-de6794a elementor-widget elementor-widget-heading\" data-id=\"de6794a\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-medium\">Automating Azure AD Auditing PowerShell: Simplifying Log Analysis Conclusion<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b0f8d90 elementor-widget elementor-widget-text-editor\" data-id=\"b0f8d90\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Azure Active Directory audit and sign-in logs provide essential information for monitoring the health and security of the tenant. Although the Azure Portal provides the option to run reports, PowerShell provides a way to automate the reporting of these logs.\u00a0<\/p><p>In this article, we explained some information provided by these logs. Additionally, we discussed how to use PowerShell to automate the analysis and configure the retention policies of these all-important Azure AD logs.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-19d12975 elementor-section-content-middle ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"19d12975\" data-element_type=\"section\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-extended\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-2ce903a7 ot-flex-column-vertical\" data-id=\"2ce903a7\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-5bcad868 elementor-widget elementor-widget-image\" data-id=\"5bcad868\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"113\" height=\"101\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2022\/05\/InfraSOS-Logo-Icon-1.png\" class=\"attachment-full size-full wp-image-5788\" alt=\"InfraSOS-AD-Tools\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-73cdd3f2 ot-flex-column-vertical\" data-id=\"73cdd3f2\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-19e84162 elementor-widget elementor-widget-heading\" data-id=\"19e84162\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Try InfraSOS for FREE<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1fc5b0ed elementor-widget elementor-widget-text-editor\" data-id=\"1fc5b0ed\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Try InfraSOS Active Directory, Azure AD &amp; Office 365 Reporting &amp; Auditing Tool<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-132bf542 elementor-button-align-center elementor-invisible elementor-widget elementor-widget-global elementor-global-5815 elementor-widget-form\" data-id=\"132bf542\" data-element_type=\"widget\" data-settings=\"{&quot;button_width&quot;:&quot;50&quot;,&quot;step_next_label&quot;:&quot;Next&quot;,&quot;step_previous_label&quot;:&quot;Previous&quot;,&quot;_animation&quot;:&quot;pulse&quot;,&quot;step_type&quot;:&quot;none&quot;,&quot;step_icon_shape&quot;:&quot;circle&quot;}\" data-widget_type=\"form.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<form class=\"elementor-form\" method=\"post\" name=\"InfraSOS Email Capture\">\n\t\t\t<input type=\"hidden\" name=\"post_id\" value=\"52295\"\/>\n\t\t\t<input type=\"hidden\" name=\"form_id\" value=\"132bf542\"\/>\n\t\t\t<input type=\"hidden\" name=\"referer_title\" value=\"Active Directory Tools, Report, Monitor &amp; Manage AD\" \/>\n\n\t\t\t\n\t\t\t<div class=\"elementor-form-fields-wrapper elementor-labels-above\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-field-type-email elementor-field-group elementor-column elementor-field-group-email elementor-col-50 elementor-field-required\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<input size=\"1\" type=\"email\" name=\"form_fields[email]\" id=\"form-field-email\" class=\"elementor-field elementor-size-lg  elementor-field-textual\" placeholder=\"Enter your email address\" required=\"required\" aria-required=\"true\">\n\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<div class=\"elementor-field-group elementor-column elementor-field-type-submit elementor-col-50 e-form__buttons\">\n\t\t\t\t\t<button type=\"submit\" class=\"elementor-button elementor-size-lg\">\n\t\t\t\t\t\t<span >\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\" elementor-button-icon\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-button-text\">Try InfraSOS FREE<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/button>\n\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t<\/form>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-668cc1bb elementor-icon-list--layout-inline elementor-list-item-link-full_width elementor-widget elementor-widget-icon-list\" data-id=\"668cc1bb\" data-element_type=\"widget\" data-widget_type=\"icon-list.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<link rel=\"stylesheet\" href=\"https:\/\/infrasos.com\/wp-content\/plugins\/elementor\/assets\/css\/widget-icon-list.min.css\">\t\t<ul class=\"elementor-icon-list-items elementor-inline-items\">\n\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item elementor-inline-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<i aria-hidden=\"true\" class=\"fas fa-arrow-up\"><\/i>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Free 15-Days Trial<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item elementor-inline-item\">\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">SaaS AD Reporting & Auditing Solution<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t<\/ul>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Automating Azure AD Auditing PowerShell: Simplifying Log Analysis. Do you want to simplify Azure AD auditing by automating it with PowerShell? We guide you through the various ways to accomplish this, starting with an overview of Azure AD auditing. In the overview section, explain the Azure Active Directory audit and sign-in logs and the information [&hellip;]<\/p>\n","protected":false},"author":12,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[35,34],"tags":[67,48],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Automating Azure AD Auditing PowerShell: Simplifying Log Analysis<\/title>\n<meta name=\"description\" content=\"Automating Azure AD Auditing PowerShell: Simplifying Log Analysis. Do you want to simplify Azure AD auditing by automating it with PowerShell? We guide\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/infrasos.com\/automating-azure-ad-auditing-powershell-simplifying-log-analysis\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Automating Azure AD Auditing PowerShell: Simplifying Log Analysis\" \/>\n<meta property=\"og:description\" content=\"Automating Azure AD Auditing PowerShell: Simplifying Log Analysis. Do you want to simplify Azure AD auditing by automating it with PowerShell? We guide\" \/>\n<meta property=\"og:url\" content=\"https:\/\/infrasos.com\/automating-azure-ad-auditing-powershell-simplifying-log-analysis\/\" \/>\n<meta property=\"og:site_name\" content=\"Active Directory Tools, Report, Monitor &amp; Manage AD\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/infrasos\/\" \/>\n<meta property=\"article:published_time\" content=\"2023-09-07T09:50:59+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-09-07T09:52:20+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/infrasos.com\/wp-content\/uploads\/elementor\/thumbs\/Automating-Azure-AD-Auditing-with-PowerShell-install-AzureADPreview-module-open-PowerShell-as-administrator-qbkopg0oqchgnpkj48zi89wg6bbqgyryahqbv6kfe6.jpg\" \/>\n<meta name=\"author\" content=\"Victor Ashiedu\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@infra_sos\" \/>\n<meta name=\"twitter:site\" content=\"@infra_sos\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Victor Ashiedu\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"11 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/infrasos.com\/automating-azure-ad-auditing-powershell-simplifying-log-analysis\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/infrasos.com\/automating-azure-ad-auditing-powershell-simplifying-log-analysis\/\"},\"author\":{\"name\":\"Victor Ashiedu\",\"@id\":\"https:\/\/infrasos.com\/#\/schema\/person\/c5852885fec0cfbb47020b1f44622ac6\"},\"headline\":\"Automating Azure AD Auditing PowerShell: Simplifying Log Analysis\",\"datePublished\":\"2023-09-07T09:50:59+00:00\",\"dateModified\":\"2023-09-07T09:52:20+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/infrasos.com\/automating-azure-ad-auditing-powershell-simplifying-log-analysis\/\"},\"wordCount\":1575,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/infrasos.com\/#organization\"},\"keywords\":[\"azure ad\",\"powershell\"],\"articleSection\":[\"Azure AD\",\"PowerShell\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/infrasos.com\/automating-azure-ad-auditing-powershell-simplifying-log-analysis\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/infrasos.com\/automating-azure-ad-auditing-powershell-simplifying-log-analysis\/\",\"url\":\"https:\/\/infrasos.com\/automating-azure-ad-auditing-powershell-simplifying-log-analysis\/\",\"name\":\"Automating Azure AD Auditing PowerShell: Simplifying Log Analysis\",\"isPartOf\":{\"@id\":\"https:\/\/infrasos.com\/#website\"},\"datePublished\":\"2023-09-07T09:50:59+00:00\",\"dateModified\":\"2023-09-07T09:52:20+00:00\",\"description\":\"Automating Azure AD Auditing PowerShell: Simplifying Log Analysis. Do you want to simplify Azure AD auditing by automating it with PowerShell? We guide\",\"breadcrumb\":{\"@id\":\"https:\/\/infrasos.com\/automating-azure-ad-auditing-powershell-simplifying-log-analysis\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/infrasos.com\/automating-azure-ad-auditing-powershell-simplifying-log-analysis\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/infrasos.com\/automating-azure-ad-auditing-powershell-simplifying-log-analysis\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/infrasos.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Automating Azure AD Auditing PowerShell: Simplifying Log Analysis\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/infrasos.com\/#website\",\"url\":\"https:\/\/infrasos.com\/\",\"name\":\"Active Directory Tools, Report, Monitor &amp; Manage AD\",\"description\":\"Active Directory &amp; Office 365 SaaS Reporting Tool\",\"publisher\":{\"@id\":\"https:\/\/infrasos.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/infrasos.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/infrasos.com\/#organization\",\"name\":\"InfraSOS - Active Directory & Office 365 Reporting Tools\",\"url\":\"https:\/\/infrasos.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/infrasos.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/infrasos.com\/wp-content\/uploads\/2022\/10\/InfraSOS-Logo-Icon.png\",\"contentUrl\":\"https:\/\/infrasos.com\/wp-content\/uploads\/2022\/10\/InfraSOS-Logo-Icon.png\",\"width\":113,\"height\":101,\"caption\":\"InfraSOS - Active Directory & Office 365 Reporting Tools\"},\"image\":{\"@id\":\"https:\/\/infrasos.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/infrasos\/\",\"https:\/\/twitter.com\/infra_sos\",\"https:\/\/www.linkedin.com\/showcase\/86283876\",\"https:\/\/www.youtube.com\/channel\/UCfGszuZdgxZYBg8DGIWxXCg\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/infrasos.com\/#\/schema\/person\/c5852885fec0cfbb47020b1f44622ac6\",\"name\":\"Victor Ashiedu\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/infrasos.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/8e12582b91f392f24c2b96a724da012a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/8e12582b91f392f24c2b96a724da012a?s=96&d=mm&r=g\",\"caption\":\"Victor Ashiedu\"},\"description\":\"Victor is an IT pro based in Manchester, UK. With over 22 years of experience managing Windows Server, Active Directory, and Powershell, and 7 years of expertise in Azure AD and Office 365, he's a seasoned expert in his field. When he's not working, he loves spending time with his family - a wife and a 5-year-old. Victor is passionate about helping businesses succeed in today's fast-changing tech landscape.\",\"sameAs\":[\"https:\/\/www.itechguides.com\/author\/victor-ashiedu\/\",\"https:\/\/www.linkedin.com\/in\/vashiedu\/\"],\"url\":\"https:\/\/infrasos.com\/author\/ashiedu5843\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Automating Azure AD Auditing PowerShell: Simplifying Log Analysis","description":"Automating Azure AD Auditing PowerShell: Simplifying Log Analysis. Do you want to simplify Azure AD auditing by automating it with PowerShell? We guide","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/infrasos.com\/automating-azure-ad-auditing-powershell-simplifying-log-analysis\/","og_locale":"en_US","og_type":"article","og_title":"Automating Azure AD Auditing PowerShell: Simplifying Log Analysis","og_description":"Automating Azure AD Auditing PowerShell: Simplifying Log Analysis. Do you want to simplify Azure AD auditing by automating it with PowerShell? We guide","og_url":"https:\/\/infrasos.com\/automating-azure-ad-auditing-powershell-simplifying-log-analysis\/","og_site_name":"Active Directory Tools, Report, Monitor &amp; Manage AD","article_publisher":"https:\/\/www.facebook.com\/infrasos\/","article_published_time":"2023-09-07T09:50:59+00:00","article_modified_time":"2023-09-07T09:52:20+00:00","og_image":[{"url":"https:\/\/infrasos.com\/wp-content\/uploads\/elementor\/thumbs\/Automating-Azure-AD-Auditing-with-PowerShell-install-AzureADPreview-module-open-PowerShell-as-administrator-qbkopg0oqchgnpkj48zi89wg6bbqgyryahqbv6kfe6.jpg"}],"author":"Victor Ashiedu","twitter_card":"summary_large_image","twitter_creator":"@infra_sos","twitter_site":"@infra_sos","twitter_misc":{"Written by":"Victor Ashiedu","Est. reading time":"11 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/infrasos.com\/automating-azure-ad-auditing-powershell-simplifying-log-analysis\/#article","isPartOf":{"@id":"https:\/\/infrasos.com\/automating-azure-ad-auditing-powershell-simplifying-log-analysis\/"},"author":{"name":"Victor Ashiedu","@id":"https:\/\/infrasos.com\/#\/schema\/person\/c5852885fec0cfbb47020b1f44622ac6"},"headline":"Automating Azure AD Auditing PowerShell: Simplifying Log Analysis","datePublished":"2023-09-07T09:50:59+00:00","dateModified":"2023-09-07T09:52:20+00:00","mainEntityOfPage":{"@id":"https:\/\/infrasos.com\/automating-azure-ad-auditing-powershell-simplifying-log-analysis\/"},"wordCount":1575,"commentCount":0,"publisher":{"@id":"https:\/\/infrasos.com\/#organization"},"keywords":["azure ad","powershell"],"articleSection":["Azure AD","PowerShell"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/infrasos.com\/automating-azure-ad-auditing-powershell-simplifying-log-analysis\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/infrasos.com\/automating-azure-ad-auditing-powershell-simplifying-log-analysis\/","url":"https:\/\/infrasos.com\/automating-azure-ad-auditing-powershell-simplifying-log-analysis\/","name":"Automating Azure AD Auditing PowerShell: Simplifying Log Analysis","isPartOf":{"@id":"https:\/\/infrasos.com\/#website"},"datePublished":"2023-09-07T09:50:59+00:00","dateModified":"2023-09-07T09:52:20+00:00","description":"Automating Azure AD Auditing PowerShell: Simplifying Log Analysis. Do you want to simplify Azure AD auditing by automating it with PowerShell? We guide","breadcrumb":{"@id":"https:\/\/infrasos.com\/automating-azure-ad-auditing-powershell-simplifying-log-analysis\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/infrasos.com\/automating-azure-ad-auditing-powershell-simplifying-log-analysis\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/infrasos.com\/automating-azure-ad-auditing-powershell-simplifying-log-analysis\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/infrasos.com\/"},{"@type":"ListItem","position":2,"name":"Automating Azure AD Auditing PowerShell: Simplifying Log Analysis"}]},{"@type":"WebSite","@id":"https:\/\/infrasos.com\/#website","url":"https:\/\/infrasos.com\/","name":"Active Directory Tools, Report, Monitor &amp; Manage AD","description":"Active Directory &amp; Office 365 SaaS Reporting Tool","publisher":{"@id":"https:\/\/infrasos.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/infrasos.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/infrasos.com\/#organization","name":"InfraSOS - Active Directory & Office 365 Reporting Tools","url":"https:\/\/infrasos.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/infrasos.com\/#\/schema\/logo\/image\/","url":"https:\/\/infrasos.com\/wp-content\/uploads\/2022\/10\/InfraSOS-Logo-Icon.png","contentUrl":"https:\/\/infrasos.com\/wp-content\/uploads\/2022\/10\/InfraSOS-Logo-Icon.png","width":113,"height":101,"caption":"InfraSOS - Active Directory & Office 365 Reporting Tools"},"image":{"@id":"https:\/\/infrasos.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/infrasos\/","https:\/\/twitter.com\/infra_sos","https:\/\/www.linkedin.com\/showcase\/86283876","https:\/\/www.youtube.com\/channel\/UCfGszuZdgxZYBg8DGIWxXCg"]},{"@type":"Person","@id":"https:\/\/infrasos.com\/#\/schema\/person\/c5852885fec0cfbb47020b1f44622ac6","name":"Victor Ashiedu","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/infrasos.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/8e12582b91f392f24c2b96a724da012a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/8e12582b91f392f24c2b96a724da012a?s=96&d=mm&r=g","caption":"Victor Ashiedu"},"description":"Victor is an IT pro based in Manchester, UK. With over 22 years of experience managing Windows Server, Active Directory, and Powershell, and 7 years of expertise in Azure AD and Office 365, he's a seasoned expert in his field. When he's not working, he loves spending time with his family - a wife and a 5-year-old. Victor is passionate about helping businesses succeed in today's fast-changing tech landscape.","sameAs":["https:\/\/www.itechguides.com\/author\/victor-ashiedu\/","https:\/\/www.linkedin.com\/in\/vashiedu\/"],"url":"https:\/\/infrasos.com\/author\/ashiedu5843\/"}]}},"_links":{"self":[{"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/posts\/52295"}],"collection":[{"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/comments?post=52295"}],"version-history":[{"count":505,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/posts\/52295\/revisions"}],"predecessor-version":[{"id":53660,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/posts\/52295\/revisions\/53660"}],"wp:attachment":[{"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/media?parent=52295"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/categories?post=52295"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/tags?post=52295"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}