How to get Azure AD reports using Powershell?

Steps to monitor Azure AD audit and sign-in logs using PowerShell:

• To retrieve audit logs within Azure AD we can use the Get-AzureADAuditDirectoryLogs cmdlet.
• Audit logs can be retrieved based on parameters such as dates, users, applications or logs containing a particular resource.

  PS C:\>Get-AzureADAuditDirectoryLogs -Filter "activityDateTime gt 2020-04-15"

  PS C:\>Get-AzureADAuditDirectoryLogs -Filter "initiatedBy/user/displayName eq 'John Doe'"

  PS C:\>Get-AzureADAuditDirectoryLogs -Filter "initiatedBy/app/displayName eq 'Office 365'"

  PS C:\>Get-AzureADAuditDirectoryLogs -Filter "targetResources/any(tr:tr/displayName eq 'Active Directory Example')"

• To get reports on sign-in logs in Azure AD, the Get-AzureADAuditSignInLogs cmdlet is used.
• Similar parameters such as date, user, location and log with a given status can be retrieved.

  PS C:\>Get-AzureADAuditSignInLogs -Filter "createdDateTime gt 2020-04-215"

  PS C:\>Get-AzureADAuditSignInLogs -Filter "userDisplayName eq 'John Doe'"

  PS C:\>Get-AzureADAuditSignInLogs -Filter "appDisplayName eq 'Office 365'"

  PS C:\>Get-AzureADAuditSignInLogs -Filter "location/city eq 'Pleasanton' and location/state eq 'California' and location/countryOrRegion eq 'US'"

  PS C:\>Get-AzureADAuditSignInLogs -Filter "status/errorCode eq 0 -All $true"

To obtain the report,

• Log in to the ADAudit Plus web console.
• Go to the Reports tab > Azure AD Tab > User Logon Reports.
• Under User Logon Reports, you will find the below mentioned reports:
  • Logon Activity
  • Logon Failures
  • Logon Failures due to bad password
  • Logon Activity by IP Address
  • Hybrid Logon Activity
  • Logon Activity by Applications Each of these reports can be further filtered as per your needs.
• Select the domain.
• Select Export as to export the report in any of the preferred formats (CSV, PDF, HTML, CSVDE and XLSX).

Screenshot: