Get-AzureADAuditDirectoryLogs format issue-CodePudding

I have this below script

Get-AzureADAuditDirectoryLogs | more

It will provide the output as below as expected; enter image description here

But when we try to export this to a .csv I am not getting the output properly

Get-AzureADAuditDirectoryLogs | more | Export-Csv C:\temp\securitylogs.csv -NoType

If you see TargetResources or Additionaldetails columns its capturing something else which is not in the actual output. Can someone please tell us what we are missing here in Export-csv command?

enter image description here

CodePudding user response：

Those properties cannot be accessed directly. I have given a reference code to display those properties.

$users = @()
$logs = Get-AzureADAuditDirectoryLogs
foreach ($log in $logs) {
    
    $obj = [PSCustomObject]@{
        ActivityDateTime  = $log.ActivityDateTime
        UserPrincipalName = $log.TargetResources.UserPrincipalName
        Category = $log.Category
    }
    $users  = $obj
}
$users | Export-Csv C:\Output\SomeFilename.csv -Force -NoTypeInformation

And also, you have to filter the logs using unique properties or matching some condition(like date), otherwise your output file will have multiple varieties of data. sample:

Get-AzureADAuditDirectoryLogs -All $true -Filter "activityDateTime le 2021-11-29 and Category eq 'UserManagement' and OperationType eq 'Update' and ActivityDisplayName eq 'Update user'"

CodePudding user response：

Hi both properties TargetResources and Additionaldetails have multiple values, so you need to be specific when extracting multiple values for the property. I'm not sure what the delimiter for those fields are.. try the following.

Get-AzureADAuditDirectoryLogs | more | Select activityDateTime, LoggedByService, ` 
OperationType, InitiatedBy,` 
@{name="TargetResources";expression={$_.TargetResources -join ";"}},` 
@{name="Additionaldetails";expression={$_.Additionaldetails -join ";"}} |`
Export-csv -NoTypeInformation C:\temp\securitylogs.csv -NoType