Would appreciate help understanding what I am doing wrong in this syntax
What I am trying to do is to get only the activities "Add user" and "Disable account" from Audit Logs using the Get-mgAuditLogDirectoryAudit cmdlt, and that happened in last 60 minutes. Below is what I am using: $currentDateTime = Get-Date $startDateTime = $currentDateTime.AddMinutes(-60).ToUniversalTime() Get-MgAuditLogDirectoryAudit -filter "activityDisplayName eq 'Add user' and ActivityDateTime ge $startDateTime" But it throws error. I am still a noob at PS so I am not able to figure out what I am doing wrong here. Am I using the wrong method to query things that happened in last 60 minutes? Would appreciate any guidance here.