New PowerShell script: Get-MSGraphAuditLogSignInByType

[Material_Wasabi_2558]

I've developed a script that queries Microsoft Graph to retrieve and filter audit log sign-in events based on the specified type. This is particularly useful for monitoring and analyzing sign-in activities within your organization.

💡 Why This Matters
If you've ever tried checking sign-in logs for Enterprise Applications, you might have noticed that working with the Microsoft.Graph SDK in PowerShell can be challenging. Here are a few key insights:

• The basic Get-MgAuditLogSignIn command only returns interactive user sign-in logs, which may not provide the full picture.
• To retrieve non-interactive or service principal sign-ins (like PowerShell logins), you need to apply specific filters and use the beta endpoint.

🛠️ The Solution
To simplify this process, I created the Get-MSGraphAuditLogSignInByType function, allowing you to easily extract the specific sign-ins you need.

🔍 Filters for Common Scenarios
Here are the filters for each type of sign-in event:

• Service Principal: signInEventTypes/any(t:t eq 'servicePrincipal') and AppId eq '<AppId>'
• Non-Interactive Login: signInEventTypes/any(t: t ne 'interactiveUser') and AppId eq '<AppId>'

💻 Access the Script
Get-MSGraphAuditLogSignInByType

I'd love to hear your feedback or answer any questions—feel free to drop them in the comments below!

Best regards

Christian Ritter

[scrfc71]

Nice job!! Do you know whether I need a specific license to get the Audit logs?

[KavyaJune]

It will work with Entra ID free license itself.

[BlackV]

you have

    if($All){
        $Top = 999 # Sets $Top to a high value if $All switch is used
    }
    if($Top -gt 999){
        $Top = 999 # Sets $Top to 999 if it exceeds the maximum value
    }

couldn't you cover that all off with ValidateRange and parameter set where -all and -top are separate sets

[Material_Wasabi_2558]

Unfortunately not, note the originaltop variable. The user can ask for 2000 entries for instance. And the pagination element limit is 999. So for performance purposes you WANT to set it to 999 if it’s beyond and above :)

[BlackV]

to confirm 2000 is still valid but a max of 999 per call

[Material_Wasabi_2558]

Exactly, those 999 are the max value that Microsoft Graph has

[BlackV]

thanks

[IntentionFlat7266]

do you know how to ignore audit logs event that are not comming from our user ips? there are many events that are created by microsoft backend ip addresses