Monday, August 26, 2019

Get Azure AD audit and sign-in Logs using PowerShell and AzureADPreview module

I ran randomly through a Microsoft documentation exposing PowerShell cmdlets to get quickly Azure AD logs.
As I had AzureAD module already installed on my computer, I tried to use them but they were not recongnized.
I understood that they, actually, were a part of another Azure AD PowerShell module: AzureADPreview.
It could be useful to use the module AzureADPreview to get quicly Azure AD Audit logs but you cannot run it if you have already the module AzureAD installed.
I had to uninstall the AzureAD module to have the AzureADPreview comdlets working as told in this forum.
Furthermore, it is, of course, not recommended by Microsoft to use the preview module for production matters.

Anyway, this is the steps to check in order to make the preview module work:

1. check there is only the AzureADPreview module installed and available

Use the
Get-module -listavailable
cmdlet to check that there is only the preview module available.

2. connect to Azure AD

use the cmdlet
connect-AzureAD
If you have AzureAD module installed, the AzureAD module will be loaded and will perform the connection, thus you won't be able to use the AzureADPreview cmdlets later.
That's why AzureAD module has to be uninstalled.
You can see on my screenshot that neither AzureAD module nor AzureADPreview module have been loaded before the connection.

3. Check that the module AzureADPreview has been loaded

To be sure that the Azure AD connection has been done by the AzureADPreview module, use the cmdlet:
Get-Module


You can notice than AzureADPreview Module has been loaded and thus, that is actually that module that has connected the PowerShell session to Azure AD.

3. Get Azure AD Audit logs with a PowerShell cmdlet

use the cmdlet Get-AzureADAuditDirectoryLogs to get the Azure AD logs:
get-azureadauditdirectorylogs


To get the Azure AD sign-ins logs you can use this cmdlet:
Get-AzureADAuditSignInLogs
However, you must have a premium subscritpion to Azure AD to be allowed to consult the sign-ins log.

No comments: