Search-UnifiedAuditLog PowerBIAudit RecordType & Get-PowerBIActivityEvent have different Results

[JChai]

Hello PowerBI community,

I am being tasked to migrate PowerBI Audit automation task with PowerShell from Search-UnifiedAuditLog command to Get-PowerBIActivityEvent command. When I was performing an integrity check between these 2 commands, I found that there are some discrepancies between both results. For example, GenerateScreenshot operation is missing from Get-PowerBIActivityEvent command but exists in Search-UnifiedAuditLog -RecordType PowerBIAudit command; AnalyzeInExcel operation is missing from Search-UnifiedAuditLog -RecordType PowerBIAudit command but exists in Get-PowerBIActivityEvent command. Both commands are found in the documentation, Track user activities in Power BI - Power BI | Microsoft Learn. The period for collecting daily audit event using both commands is from 2022 September 22 to 2022 September 29.

I was under the impression that both of these commands should return the same results. Therefore, I am not certain if this is a bug or both commands are actually different when collecting Power BI Audit activity event. However, there are more operations that I found exists in Get-PowerBIActivityEvent but not in Search-UnifiedAuditLog -RecordType PowerBIAudit . Any further guidance and/or resolutions for this will be truly appreciated. Thanks.

JKChai

[v-mengzhu-msft]

Hi @JChai ,

As you said,we can find the two option:  GenerateScreenshot and AnalyzeInExcel in audit and activity logs.

My guess is that there are inconsistencies in what the command headers can look for, thus leading to differences in the results of the resulting operation.

Best regards,

Community Support Team Selina zhu