Can't get multiple results-CodePudding

I have the following PowerShell code that should run and fetch the last login for the list of UPNs:

$UPNList = get-content c:\temp\users.txt
foreach ($User in $UPNList) 
{
Start-Sleep -Milliseconds 1000
$result = Get-AzureADAuditSignInLogs -Filter "UserPrincipalName eq '$User'" -Top 1 | Select-Object CreatedDateTime, UserPrincipalName, IsInteractive, AppDisplayName, IpAddress, TokenIssuerType, @{Name = 'DeviceOS'; Expression = {$_.DeviceDetail.OperatingSystem}}
$result | Export-Csv -Path 'c:\temp\results.txt' -NoTypeInformation -Append
}

However, the "results.txt" file is empty when there is more than one (1) user in the input file. If there's a single user, results are correctly returned. How can I ensure the results are provided for all users?

Also, if the user did not log in at all, for example completely new account, how do I ensure that the UPN is still populated in the "results" file, but the rest of the details are empty? Thank you.

CodePudding user response：

I tried to reproduce the same in my environment and got below results:

Initially, I checked with one user in users.txt file like this:

enter image description here

I ran the same script as you and got the response like below:

$UPNList = get-content c:\test\users.txt
foreach ($User in $UPNList) 
{
Start-Sleep -Milliseconds 1000
$result = Get-AzureADAuditSignInLogs -Filter "UserPrincipalName eq '$User'" -Top 1 | Select-Object CreatedDateTime, UserPrincipalName, IsInteractive, AppDisplayName, IpAddress, TokenIssuerType, @{Name = 'DeviceOS'; Expression = {$_.DeviceDetail.OperatingSystem}}
$result | Export-Csv -Path 'c:\test\results.txt' -NoTypeInformation -Append
}

Output:

enter image description here

In results.txt file, I got the details of that user successfully like below:

enter image description here

Now I tried including more UPNs in users.txt file like below:

enter image description here

When I ran the same script, the results.txt file is empty as below:

enter image description here

Please note that, the response in results.txt file differs based on how you are giving input in users.txt file.

I tried changing the format of giving input in users.txt file like below:

enter image description here

Now, when I ran the script again, I got the details of those users successfully like below:

enter image description here

So, make sure to give input for users.txt file in correct format.

If the user did not log in at all, it's not possible to get their details using Get-AzureADAuditSignInLogs command.

Normally, you can make use of Get-AzureADUser command to get any user details.

CodePudding user response：

Try not to write out to the output file in every iteration, but have PowerShell collect the objects you output inside the loop and then create the csv file:

# get the list of UPN's and skip empty lines
$UPNList = Get-Content -Path 'c:\test\users.txt' | Where-Object { $_ -match '\S' }

# loop through the list and collect the data in variable $result
$result = foreach ($User in $UPNList) {
    # output the wanted data
    Get-AzureADAuditSignInLogs -Filter "UserPrincipalName eq '$User'" -Top 1 | 
    Select-Object CreatedDateTime, UserPrincipalName, IsInteractive, AppDisplayName, IpAddress, 
                  TokenIssuerType, @{Name = 'DeviceOS'; Expression = {$_.DeviceDetail.OperatingSystem}}
}

# now write the collected data to CSV file in one go
$result | Export-Csv -Path 'c:\test\results.csv' -NoTypeInformation

You may also try to do the filtering afterwards like below (could be slower than above code though)

# get the list of UPN's and skip empty lines
$UPNList = Get-Content -Path 'c:\test\users.txt' | Where-Object { $_ -match '\S' }
# filter with Where-Object afterwards and pipe through to the Export-Csv cmdlet
Get-AzureADAuditSignInLogs -All $true | Where-Object { $UPNList -contains $_.UserPrincipalName } |
Select-Object CreatedDateTime, UserPrincipalName, IsInteractive, AppDisplayName, IpAddress, 
              TokenIssuerType, @{Name = 'DeviceOS'; Expression = {$_.DeviceDetail.OperatingSystem}} |
Export-Csv -Path 'c:\test\results.csv' -NoTypeInformation