Roles required for Search-UnifiedAuditLog

We're setting up a scheduled script to export logs through the Powershell cmd Search-UnifiedAuditLog. However, since all our Administrators use MFA, we need to use a separate user with no MFA, ...

Dominik Hoefling
Jan 24, 2018
Hi,

You can check it with this cmdlet in Exchange Online PowerShell:

PS C:\Users\domin> Get-ManagementRoleEntry "*\Search-UnifiedAuditLog"

Name                           Role                      Parameters
----                           ----                      ----------
Search-UnifiedAuditLog         View-Only Audit Logs      {Debug, EndDate, ErrorAction, ErrorVariable...}
Search-UnifiedAuditLog         Audit Logs                {Debug, EndDate, ErrorAction, ErrorVariable...}

You can modifiy the permissions via RBAC and only grab the necessary cmdlet's that you will need. Both roles are the default roles in Exchange Online.

Dominik Hoefling

MVP

Jan 24, 2018

Hi,

You can check it with this cmdlet in Exchange Online PowerShell:

PS C:\Users\domin> Get-ManagementRoleEntry "*\Search-UnifiedAuditLog"

Name                           Role                      Parameters
----                           ----                      ----------
Search-UnifiedAuditLog         View-Only Audit Logs      {Debug, EndDate, ErrorAction, ErrorVariable...}
Search-UnifiedAuditLog         Audit Logs                {Debug, EndDate, ErrorAction, ErrorVariable...}

You can modifiy the permissions via RBAC and only grab the necessary cmdlet's that you will need. Both roles are the default roles in Exchange Online.

Ruben Demey

Copper Contributor

Jan 24, 2018

Hi Dominik,

Thanks, that clarifies a lot.

I'm still getting an error that the cmdlet isn't existing. Do I need to assign specific O365 licenses for this to work to the user? (which would be a shame)

Forum Discussion

Roles required for Search-UnifiedAuditLog