cancel
Showing results for 
Search instead for 
Did you mean: 

[HOWTO] Export Office 365 Audit Logs with focus on Power BI using PowerShell

PRODUCTS / COMPONENTS INVOLVED

  • Microsoft Power BI 
  • Microsoft Office 365 - Audit Logs
  • PowerShell

 

PROBLEM SCENARIO DESCRIPTION / GOAL

The goal here, is to look for a remote way that one can export the Office 365 Audit Log with a focus on Power BI for a given data range.

 

RESOLUTION ( SCRIPT )

The below script I was able to get to work in my environment.  It is very simple to provide an illustration of how to achieve the given goal.

 

NOTE: The following script is provided as a sample / illustration.

Script Block

Set-ExecutionPolicy RemoteSigned
$UserCredential = Get-Credential
#the link specified here is strictly for use in the powershell and you will need to authenticate to use it
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection
Import-PSSession $Session
Search-UnifiedAuditLog -StartDate 4/11/2019 -EndDate 5/9/2019 -RecordType PowerBI -ResultSize 1000 | Format-Table | More

 

ADDITIONAL INFORMATION / RESOURCE LINKS

Here is product documentaton on the Search-UnifiedAuditLog PowerShell cmdlet:  https://docs.microsoft.com/en-us/powershell/module/exchange/policy-and-compliance-audit/search-unifi...

 

Comments

@timmac  Doesn the credentials to run this command requries PowerBI Admin Role (or) O365 Global Admini ?

@Jayendran thank you for the comment - the PowerShell cmdlet Search-UnifiedAuditLog is actually an Exchange PowerShell script.  That stated, Power BI Admin permissions will not be needed here.  

At the time that I put the blog together, I did utilize an Office 365 Global Admin account.  However, that stated, within the Search-UnifiedSmiley Very Happyescription: https://docs.microsoft.com/en-us/powershell/module/exchange/policy-and-compliance-audit/search-unifi... it does talk about needing some permissions from Exchange to be able to run this script.  

 

o365auditlog.JPG


I would take a look at : https://technet.microsoft.com/library/mt432940.aspx.

----
I went through the steps in the article to connect to Exchange Online and dump the RoleType for the cmdlet.


Exchange Online PowerShell cmdlet Permissions
https://docs.microsoft.com/en-us/powershell/exchange/exchange-server/find-exchange-cmdlet-permission...

 

o365auditlogroletype.JPG