SPOTenant but more

Hi demipoulpe,

the `Get-SPOTenant` cmdlet doesn't provide the details of who made tenant changes and when. To get this information, you'll need to use PowerShell and the Microsoft 365 audit logs.

1: Connect to Microsoft 365 Security & Compliance Center

First, open PowerShell and connect to the Microsoft 365 Security & Compliance Center. You'll need to install and import the required modules if you haven't already. This is done to access the audit logs:

# Install the required module
Install-Module -Name ExchangeOnlineManagement

# Import the module
Import-Module ExchangeOnlineManagement

# Connect to Microsoft 365 Security & Compliance Center
Connect-ExchangeOnline -UserPrincipalName <your_admin_account>

* Replace `<your_admin_account>` with your actual admin account.

2: Search for Audit Log Entries

use the `Search-UnifiedAuditLog` cmdlet to search for audit log entries related to SharePoint Online tenant setting changes. You can specify a date range and filter for specific events. For example, to look for SharePoint admin activities in the last 7 days:

$startDate = (Get-Date).AddDays(-7)
$endDate = Get-Date

$auditLogEntries = Search-UnifiedAuditLog -StartDate $startDate -EndDate $endDate -Operations "SharePoint Settings" -ResultSize Unlimited

3: Retrieve Details

Once you have the audit log entries, you can extract information about who made the changes and when. Here's how to do it:

foreach ($entry in $auditLogEntries) {
$details = $entry.Details | ConvertFrom-Json
$user = $details.UserId
$timestamp = $entry.CreationDate

Write-Host "User: $($user.UserKey)"
Write-Host "Timestamp: $($timestamp)"
}

This code loops through the audit log entries, extracting user information and time for each change.