Forum Discussion
Getting last sign-in logs for specific AzureAD group and exporting to excel
Data does appear but an error stops me from getting everything
I get this error when I run the script how do I avoid or skip this?
Error message:
Get-AzureADAuditSignInLogs : Error occurred while executing GetAuditSignInLogs
Code: UnknownError
Message: Too Many Requests
InnerError:
RequestId: 0630b986-72ca-4411-91cd-8c6e90db3196
DateTimeStamp: Fri, 10 Jun 2022 02:46:41 GMT
HttpStatusCode: 429
HttpStatusDescription:
HttpResponseStatus: Completed
At line:9 char:10
+ $logs = Get-AzureADAuditSignInLogs -Filter "userprincipalname eq `'$ ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [Get-AzureADAuditSignInLogs], ApiException
+ FullyQualifiedErrorId : Microsoft.Open.MSGraphBeta.Client.ApiException,Microsoft.Open.MSGraphBeta.PowerShell.GetAuditSignInLogs
Script Created:
# Set-ExecutionPolicy -ExecutionPolicy RemoteSigned
# Install-Module -Name AzureADPreview
# Import-Module -Name AzureADPreview
# UnInstall-Module -Name AzureAD
# Get-Module
# Connect-AzureAD
##Get all guest users
$guests = Get-AzureADGroupMember -ObjectId "" -All $True
##Loop Guest Users
foreach ($guest in $guests) {
##Get logs filtered by current guest
$logs = Get-AzureADAuditSignInLogs -Filter "userprincipalname eq `'$($guest.mail)'" -All $True
##Check if multiple entries and tidy results
if ($logs -is [array]) {
$timestamp = $logs[0].createddatetime
}
else {
$timestamp = $logs.createddatetime
}
##Build Output Object
$object = [PSCustomObject]@{
Userprincipalname = $guest.userprincipalname
LastSignin = $timestamp
}
##Export Results
$object | export-csv C:\Temp\GuestUserSignins.csv -NoTypeInformation -Append
Remove-Variable object
}
- I think you're "flooding", you could add a start-sleep -seconds 1 after ##Get logs filtered by current guest ?
- I think you're "flooding", you could add a start-sleep -seconds 1 after ##Get logs filtered by current guest ?
- Newbie_JonesBrass ContributorOr get all logs once and store them into a variable. (Just after you get the guest users).
Then filter on this variable in the loop. (Pipe the variable into a where-object) - Flippantboy13Copper Contributor
Thank you Harm_Veenstra, adding that buffer fixed the issue and I get all the data I needed.
- Good to hear! Please mark my answer as solution to mark it solved
- Alan2022Iron ContributorFlippantboy13
Never do this inside the loop
$logs = Get-AzureADAuditSignInLogs -Filter "userprincipalname eq `'$($guest.mail)'" -All
It will do a server query each time root cause of the too many request.
$logs + Where-Object is the local filtering.