[HOWTO] Export Office 365 Audit Logs with focus on Power BI using PowerShell

[timmac]

PRODUCTS / COMPONENTS INVOLVED

• Microsoft Power BI 
• Microsoft Office 365 - Audit Logs
• PowerShell

PROBLEM SCENARIO DESCRIPTION / GOAL

The goal here, is to look for a remote way that one can export the Office 365 Audit Log with a focus on Power BI for a given data range.

RESOLUTION ( SCRIPT )

The below script I was able to get to work in my environment.  It is very simple to provide an illustration of how to achieve the given goal.

NOTE: The following script is provided as a sample / illustration.

Script Block

Set-ExecutionPolicy RemoteSigned $UserCredential = Get-Credential #the link specified here is strictly for use in the powershell and you will need to authenticate to use it $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection Import-PSSession $Session Search-UnifiedAuditLog -StartDate 4/11/2019 -EndDate 5/9/2019 -RecordType PowerBI -ResultSize 1000 | Format-Table | More

ADDITIONAL INFORMATION / RESOURCE LINKS

Here is product documentaton on the Search-UnifiedAuditLog PowerShell cmdlet:  https://docs.microsoft.com/en-us/powershell/module/exchange/policy-and-compliance-audit/search-unifi...

[Jayendran]

@timmac  Doesn the credentials to run this command requries PowerBI Admin Role (or) O365 Global Admini ?

[timmac]

@Jayendran thank you for the comment - the PowerShell cmdlet Search-UnifiedAuditLog is actually an Exchange PowerShell script.  That stated, Power BI Admin permissions will not be needed here.  

At the time that I put the blog together, I did utilize an Office 365 Global Admin account.  However, that stated, within the Search-Unified:Description: https://docs.microsoft.com/en-us/powershell/module/exchange/policy-and-compliance-audit/search-unifi... it does talk about needing some permissions from Exchange to be able to run this script.  

I would take a look at : https://technet.microsoft.com/library/mt432940.aspx.

----
I went through the steps in the article to connect to Exchange Online and dump the RoleType for the cmdlet.

Exchange Online PowerShell cmdlet Permissions
https://docs.microsoft.com/en-us/powershell/exchange/exchange-server/find-exchange-cmdlet-permission...