Jan 21 2019 05:37 AM
Is it possible to run a PS script of some sort which would identify all users who are connecting to O365 services (Exchange) using basic auth.
When we run the report via the GUI in Azure AD Sign-In's blade and filter by 'Client App' - this gives u the info we need but the export is limited to 5000 events.
Is there a way to extract this info to a CSV via PowerShell?
Jan 21 2019 10:04 AM
Use the Azure AD blade or the Graph API. The "Script" button next to the "Download" one gives you a ready-to-use PowerShell script that queries the Graph API and fetches all the results, so you don't have to write your own.
If you want to use "standard" PowerShell, your best bet is the Unified Audit Log in the SCC, which unfortunately has been plagued with issues lately. Still, you can try getting the results via the Search-UnifiedAuditLog
May 08 2019 05:14 AM