Hi @demipoulpe,
the `Get-SPOTenant` cmdlet doesn't provide the details of who made tenant changes and when. To get this information, you'll need to use PowerShell and the Microsoft 365 audit logs.
1: Connect to Microsoft 365 Security & Compliance Center
First, open PowerShell and connect to the Microsoft 365 Security & Compliance Center. You'll need to install and import the required modules if you haven't already. This is done to access the audit logs:
# Install the required module
Install-Module -Name ExchangeOnlineManagement
# Import the module
Import-Module ExchangeOnlineManagement
# Connect to Microsoft 365 Security & Compliance Center
Connect-ExchangeOnline -UserPrincipalName <your_admin_account>
* Replace `<your_admin_account>` with your actual admin account.
2: Search for Audit Log Entries
use the `Search-UnifiedAuditLog` cmdlet to search for audit log entries related to SharePoint Online tenant setting changes. You can specify a date range and filter for specific events. For example, to look for SharePoint admin activities in the last 7 days:
$startDate = (Get-Date).AddDays(-7)
$endDate = Get-Date
$auditLogEntries = Search-UnifiedAuditLog -StartDate $startDate -EndDate $endDate -Operations "SharePoint Settings" -ResultSize Unlimited
3: Retrieve Details
Once you have the audit log entries, you can extract information about who made the changes and when. Here's how to do it:
foreach ($entry in $auditLogEntries) {
$details = $entry.Details | ConvertFrom-Json
$user = $details.UserId
$timestamp = $entry.CreationDate
Write-Host "User: $($user.UserKey)"
Write-Host "Timestamp: $($timestamp)"
}
This code loops through the audit log entries, extracting user information and time for each change.
Please click Mark as Best Response & Like if my post helped you to solve your issue.
This will help others to find the correct solution easily. It also closes the item.
If the post was useful in other ways, please consider giving it Like.
Kindest regards,
Leon Pavesic
