Powershell Get Members of a Team and the Date they Joined only getting last 2 month and half

Copper Contributor

I am working on scrip to get users who  joined Members groups for last year but I keep only getting the last 2 month and half.

 

#Connect-ExchangeOnline -UserPrincipalName myaccount.env.com 
$OutputFile = "C:\temp\location.csv"
$UserInfoCollection= @()

$ObjectId = Get-UnifiedGroup -Identity "email address removed for privacy reasons" | Select -ExpandProperty ExternalDirectoryObjectId

#$Records = Search-UnifiedAuditLog -FreeText $ObjectId -StartDate 1/1/2023 -EndDate 8/2/2023 -ResultSize 1000 -Operations "MemberAdded"
$Records = Search-UnifiedAuditLog -FreeText $ObjectId -StartDate 8/10/2022 -EndDate 8/9/2023
#$Records | Group Operations | Sort Count -Descending | Format-Table Name, Count

Foreach($record in $Records) {

if ($record.Operations -eq "MemberAdded") {
#Send Data to an object array
$UserInfo = new-object psobject
Write-Host "User Email" $record.UserIds + "Created Date" $record.CreationDate + "type" $record.Operations
$UserInfo | add-member noteproperty -name "User Email " -value $record.UserIds
$UserInfo | add-member noteproperty -name "Create/Joined Date" -value $record.CreationDate
$UserInfo | add-member noteproperty -name "Type" -value $record.Operations
#Add to Array
$UserInfoCollection+=$UserInfo

}
}

$UserInfoCollection | export-csv $OutputFile -notypeinformation
#Disconnect-ExchangeOnline

2 Replies
The Unified audit log only keeps event for 90 days by default. To go over that window, you need to have Audit Premium: https://learn.microsoft.com/en-us/purview/audit-premium
Or export the events periodically to another system and run your queries against it.
@vasil Or export the events periodically to another system and run your queries against it. not sure what you mean