SPOTenant but more

Copper Contributor

Hi !

I'd like to monitor setting change at  a tenant level in SPO .  

Get-SPOTenant retreive me some nice data  :


IsWBFluidEnabled : True
IsCollabMeetingNotesFluidEnabled : True
IsLoopEnabled : True


but I'd like to knwow who/when the tenant's setting were updated 

If there a smart way to access this kind of  information in Powershell ? 

1 Reply

Hi @demipoulpe,

the `Get-SPOTenant` cmdlet doesn't provide the details of who made tenant changes and when. To get this information, you'll need to use PowerShell and the Microsoft 365 audit logs.

1: Connect to Microsoft 365 Security & Compliance Center

First, open PowerShell and connect to the Microsoft 365 Security & Compliance Center. You'll need to install and import the required modules if you haven't already. This is done to access the audit logs:

# Install the required module
Install-Module -Name ExchangeOnlineManagement

# Import the module
Import-Module ExchangeOnlineManagement

# Connect to Microsoft 365 Security & Compliance Center
Connect-ExchangeOnline -UserPrincipalName <your_admin_account>


* Replace `<your_admin_account>` with your actual admin account.

2: Search for Audit Log Entries

use the `Search-UnifiedAuditLog` cmdlet to search for audit log entries related to SharePoint Online tenant setting changes. You can specify a date range and filter for specific events. For example, to look for SharePoint admin activities in the last 7 days:


$startDate = (Get-Date).AddDays(-7)
$endDate = Get-Date

$auditLogEntries = Search-UnifiedAuditLog -StartDate $startDate -EndDate $endDate -Operations "SharePoint Settings" -ResultSize Unlimited


3: Retrieve Details

Once you have the audit log entries, you can extract information about who made the changes and when. Here's how to do it:

foreach ($entry in $auditLogEntries) {
$details = $entry.Details | ConvertFrom-Json
$user = $details.UserId
$timestamp = $entry.CreationDate

Write-Host "User: $($user.UserKey)"
Write-Host "Timestamp: $($timestamp)"


This code loops through the audit log entries, extracting user information and time for each change.

Please click Mark as Best Response & Like if my post helped you to solve your issue.
This will help others to find the correct solution easily. It also closes the item.

If the post was useful in other ways, please consider giving it Like.

Kindest regards,

Leon Pavesic