Office 365: How to query Audit Log using PowerShell!

In the same way we can query the Office 365 Audit Log by means of the Security & Compliance Center, we can query it using PowreShell and the Search-UnifiedAuditLog as the following code snippted demonstrates:

$sUserName="<Office365User>@<Office365Domain>"
$sMessage="Introduce your O365 Credentials"
$Cred=Get-Credential -UserName $sUserName -Message $sMessage
#Configure a Group to use classification:
$PSSession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $Cred -Authentication Basic -AllowRedirection

Import-PSSession $PSSession
Search-UnifiedAuditLog -StartDate 5/1/2017 -EndDate 5/8/2017 -RecordType SharePointFileOperation -Operations FileAccessed -SessionId "Docs_SharepointViews"-SessionCommand ReturnNextPreviewPage

Reference:

Anuncios

Office 365: Como consultar el Log de Auditoria con PowerShell!

De la misma forma que podemos consultar el Log de auditoria de Office 365 a través del Security & Compliance Center, podemos consultarlo por medio de Powershell y el comando Search-UnifiedAuditLog como se muestra en la siguiente code snippet:

$sUserName="<Office365User>@<Office365Domain>"
$sMessage="Introduce your O365 Credentials"
$Cred=Get-Credential -UserName $sUserName -Message $sMessage
#Configure a Group to use classification:
$PSSession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $Cred -Authentication Basic -AllowRedirection

Import-PSSession $PSSession
Search-UnifiedAuditLog -StartDate 5/1/2017 -EndDate 5/8/2017 -RecordType SharePointFileOperation -Operations FileAccessed -SessionId "Docs_SharepointViews"-SessionCommand ReturnNextPreviewPage

Referencia: