Forum Discussion
Search-UnifiedAuditLog - List of users.
Why don't you simply export the sign-in logs from the Azure AD portal?
Hey Vasil, Because i need to be able to run this against a list of users, and also i didn't see that the audit log reports in office (Sec and Compliance) reported the last sign in date.
Also there is more data in the script below than is provided by the canned audit log reports in the sec and comp center.
Thanks,
Robert
I'm referring to the sign-in logs in the Azure AD portal, which are the source of truth when it comes to the "last logged" date, it flows from there to the SCC. https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-sign-ins
This is the string i came up with to try and use my input list:
Import-Csv .\VIPUsers1018.csv | foreach {Search-UnifiedAuditLog -StartDate "04-01-2020" -EndDate "04-10-2020" -UserIds $_.PrimarySMTPAddress -ResultSize 5000}
But it returns blank results (no errors) and of course i would still need to connect it with my variables.
Robert
