search

12Knocksinna / Office365itpros

Office 365 for IT Pros PowerShell examples
MIT License
1.24k stars 559 forks source link

Audit Log retention? #65

Closed myatix closed 1 year ago

myatix commented 1 year ago

Hi,

I was just looking at the "FindOldGuestUsers.ps1" script and can see that this uses the "Get-AzureADAuditSignInLogs" which is part of AzureADPreview module. The issue is that the AuditLog is limited to 30 days, so I was wondering how this script is suppose to work?

Also when you run the script you very quickly seem to get hit by MS throttling

image

I see the concept but in reality, this doesn't work passed 30 days, which is a little irrelevant.

12Knocksinna commented 1 year ago

It's an old script that uses the soon to be retired Azure AD module. Today, I would use the Microsoft Graph PowerShell SDK and the Get-MgAuditSignInLogs cmdlet. I have no idea why you're being throttled.

12Knocksinna commented 1 year ago

I updated the script to use SDK cmdlets. It shouldn't be throttled now because the code doesn't read the audit logs. Instead, it gets the last sign in date from the user account.