Blog Post

Exchange Team Blog
7 MIN READ

Monitoring Exchange Online User Client Access and Usage with Graph, PowerShell and Power BI

The_Exchange_Team's avatar
The_Exchange_Team
Icon for Microsoft rankMicrosoft
Jan 21, 2019
Introduction As a Tenant Admin of an Office 365 Exchange Online organization, have you ever needed to monitor who, what, and where someone is connecting to your Exchange Online resources, like acc...
Updated Jul 01, 2019
Version 2.0
exchange online
Tips 'n Tricks
tools
Deleted's avatar
Deleted
Wondering if you might be able to help me. I am geting a 403 error.

$resultSet = (Invoke-WebRequest -UseBasicParsing -Headers $headerParams -Uri $url)

Invoke-WebRequest : The remote server returned an error: (403) Forbidden.

Deleted's avatar
Deleted
Jan 22, 2019
JFoley2222,

During the creation and testing of this article we encountered this only when the tenant wasn't licensed for Azure AD Premium 1 or 2. You can start a trail on your tenant if you don't already have it by going here: https://azure.microsoft.com/en-us/trial/get-started-active-directory/.

Thanks,

Dana Garcia

  • Deleted's avatar
    Deleted
    Jan 22, 2019
    I confirmed we are Azure AD Premium P1. I will continue to look at why I might be seeing this.
    • Deleted's avatar
      Deleted
      Jan 22, 2019
      will it work off365 Azure AD ? I am getting

      PS C:\Users\Satya> C:\satyam\scrips\o365loginaccess.ps1

      Invoke-WebRequest : The remote server returned an error: (403) Forbidden.

      • Deleted's avatar
        Deleted
        Jan 22, 2019
        Hi Satya11,

        The requirements to use this solution are to have a tenant with Azure AD Premium 1 or 2, or a trial subscription for either of those.

        Thanks,

        Dana Garcia

    • Deleted's avatar
      Deleted
      Jan 22, 2019
      One last thing is, make sure the domain you specified is your default domain I.E. if you have a custom domain contoso.com and your default tenant domain is contoso.onmicrosoft.com you would need to provide contoso.onmicrosoft.com.

      Thanks,

      Dana Garcia

      • Deleted's avatar
        Deleted
        Jan 22, 2019
        Supplementary : @Carolyn Billups - if I change the logon to a user logon rather than logging on as a the app itself, then if the user has suitable privileges it works every time. Trying to do this as set out here - so the person running the script doesn't even need to have their own account in the tenant, but uses app's ID and Secret as a credential to for one scope of tasks (reading logs) seems to be unreliable.

        I'm using it with a different mode of logging on and ( @ Dana) I've found 3 or 4 really useful nuggets of knowledge out of this - so thanks for the good work !

    • Deleted's avatar
      Deleted
      Jan 22, 2019
      JFoley2222,

      In this case, I would look at the application registration with Azure AD and Graph. Ensure that Graph has been granted permissions to Read all audit log data and that the "Grant Permissions" button was clicked followed by "Yes". Also I would generate a new Key Secret and triple check the values you put in the script for any leading or trailing spaces. Please let me know if this doesn't resolve your issue.

      Thanks,

      Dana Garcia