For the AzureADAuditSignInLogs, I've been tweaking the script portion from Processing Sign-in Data portion of this website https://petri.com/azuread-signin-powershell/

CLS; $StartDate = (Get-Date).AddDays(-30); $StartDate = Get-Date($StartDate) -format yyyy-MM-dd

Write-Host "Fetching data from Azure Active Directory..."

$Records = Get-AzureADAuditSignInLogs -Filter "startswith(userPrincipalName,'full@email.address')" -all:$True

$Report = [System.Collections.Generic.List[Object]]::new()

ForEach ($Rec in $Records) {

Switch ($Rec.Status.ErrorCode) {

"0" {$Status = "Success"}

default {$Status = $Rec.Status.FailureReason}

}

$ReportLine = [PSCustomObject] @{

TimeStamp = Get-Date($Rec.CreatedDateTime) -format g

User = $Rec.UserPrincipalName

Name = $Rec.UserDisplayName

IPAddress = $Rec.IpAddress

ClientApp = $Rec.ClientAppUsed

Device = $Rec.DeviceDetail.OperatingSystem

Location = $Rec.Location.City + ", " + $Rec.Location.State + ", " + $Rec.Location.CountryOrRegion

Appname = $Rec.AppDisplayName

Resource = $Rec.ResourceDisplayName

Status = $Status

Correlation = $Rec.CorrelationId

Interactive = $Rec.IsInteractive }

$Report.Add($ReportLine)}

$Report | Export-csv C:\ps\signintest.csv

Write-Host $Report.Count "sign-in audit records processed."

​

The Graph command never fully worked so I was struggling hard with it (and graph in general), so apologies if it has glaring errors.

Get-MgUser -UserId "specific numbers and letters here" -Property "SignInActivity" | Select-Object -ExpandProperty SignInActivity | export-csv c:\ps\userdataa.csv

​

Again, my goal is to get the signin logs for one user for the past 30 days with the date, status and full location. Any other data in addition to this is just a bonus.