PowerShell Risky Sign In events shows 100 entries

Copper Contributor

Hi All,


I'm using PowerShell to write the Risky Sign In events to a CSV-file. 

It only shows 100 entries though, I think I'm overseeing something easy, but can you help me out? 


 $loginURL = "https://login.microsoft.com"
$resource = "https://graph.microsoft.com"
$body = @{grant_type = "client_credentials"; resource = $resource; client_id = $ClientID; client_secret = $ClientSecret}
$oauth = Invoke-RestMethod -Method Post -Uri $loginURL/$tenantdomain/oauth2/token?api-version=1.0 -Body $body
Write-Output $oauth
if ($oauth.access_token -ne $null)
$headerParams = @{'Authorization' = "$($oauth.token_type) $($oauth.access_token)"}
$url = "https://graph.microsoft.com/beta/identityRiskEvents"
Write-Output $url
$myReport = (Invoke-WebRequest -UseBasicParsing -Headers $headerParams -Uri $url)
foreach ($event in ($myReport.Content | ConvertFrom-Json).value)
Write-Output $event
Write-Host "ERROR: No Access Token"
} }


That's the part I'm using to get all info, yet it's only 100 entries.. 


1 Reply

I don't have that many events in my tenant to test this, but usually it will return a "next link" element as detailed here: https://developer.microsoft.com/en-us/graph/docs/concepts/paging