Track user activities in Power BI

Knowing who is taking what action on which item in Power BI can be critical in helping your organization fulfill its requirements, like meeting regulatory compliance and records management. This article discusses two options to track user activity: The Power BI activity log and the unified audit log.

Choosing a log source

The Power BI Activity Log and unified audit log both contain a complete copy of the Power BI auditing data. However, we highly recommend using the Power BI Activity Log for the following reasons:

• The Power BI Activity Log contains only the Power BI activities structured list of records (JSON array).
• The global administrator role isn't needed to access the Power BI Activity Log.

The differences between log sources are summarized in the following table.

Use the activity log

Power BI administrators can analyze usage for all Power BI resources at the tenant level by using custom reports that are based on the Power BI activity log. You download the activities by using a REST API or PowerShell cmdlet. Filter activity data by date range, user, and activity type.

Activity log requirements

To access the Power BI activity log, you must meet these requirements:

• You have to be a global admin or a Power BI Administrator.
• Install the Power BI Management cmdlets locally or use the Power BI Management cmdlets in Azure Cloud Shell.

ActivityEvents REST API

You can use an administrative application based on the Power BI REST APIs to export activity events into a blob store or SQL database. You can then build a custom usage report on top of the exported data. In the ActivityEvents REST API call, you must specify a start date and end date and optionally a filter to select activities by activity type or user ID. Because the activity log could contain a large amount of data, the ActivityEvents API currently only supports downloading up to one day of data per request. In other words, the start date and end date must specify the same day, as in the following example. Make sure you specify the DateTime values in UTC format.

https://api.powerbi.com/v1.0/myorg/admin/activityevents?startDateTime='2019-08-31T00:00:00'&endDateTime='2019-08-31T23:59:59'

If the number of entries is large, the ActivityEvents API returns only around 5,000 to 10,000 entries and a continuation token. Call the ActivityEvents API again with the continuation token to get the next batch of entries, and so forth, until you've gotten all entries and no longer receive a continuation token. The following example shows how to use the continuation token.

https://api.powerbi.com/v1.0/myorg/admin/activityevents?continuationToken='%2BRID%3ARthsAIwfWGcVAAAAAAAAAA%3D%3D%23RT%3A4%23TRC%3A20%23FPC%3AARUAAAAAAAAAFwAAAAAAAAA%3D'

No matter how many entries are returned, if the results include a continuation token, make sure you call the API again using that token to get the rest of the data, until a continuation token is no longer returned. It's possible for a call to return a continuation token without any event entries. The following example shows how to loop with a continuation token returned in the response:

while(response.ContinuationToken != null)
{
   // Store the activity event results in a list for example
    completeListOfActivityEvents.AddRange(response.ActivityEventEntities);

    // Make another call to the API with continuation token
    response = GetPowerBIActivityEvents(response.ContinuationToken)
}
completeListOfActivityEvents.AddRange(response.ActivityEventEntities);

If the time span between startDateTime and endDateTime exceeds 1 hour, it takes multiple requests to download the data through continuationUri in response.

The following example shows how to download data for 1 hour and 5 minutes:

GET https://wabi-staging-us-east-redirect.analysis.windows.net/v1.0/myorg/admin/activityevents?startDateTime='2020-08-13T07:55:00Z'&endDateTime='2020-08-13T09:00:00Z'
{
  "activityEventEntities": […],
  "continuationUri": https://wabi-staging-us-east-redirect.analysis.windows.net/v1.0/myorg/admin/activityevents?continuationToken='LDIwMjAtMDgtMTNUMDc6NTU6MDBaLDIwMjAtMDgtMTNUMDk6MDA6MDBaLDEsLA%3D%3D',
  "continuationToken": "LDIwMjAtMDgtMTNUMDc6NTU6MDBaLDIwMjAtMDgtMTNUMDk6MDA6MDBaLDEsLA%3D%3D",
  "lastResultSet": false
}

GET https://wabi-staging-us-east-redirect.analysis.windows.net/v1.0/myorg/admin/activityevents?continuationToken='LDIwMjAtMDgtMTNUMDc6NTU6MDBaLDIwMjAtMDgtMTNUMDk6MDA6MDBaLDEsLA%3D%3D'
{
  "activityEventEntities": [],
  "continuationUri": null,
  "continuationToken": null,
  "lastResultSet": false
}

To learn more about using the Power BI REST API, including examples of how to get audit activity events, see Admin - Get Activity Events in the Power BI REST API reference documentation.

Get-PowerBIActivityEvent cmdlet

Download activity events by using the Power BI Management cmdlets for PowerShell. The Get-PowerBIActivityEvent cmdlet automatically handles the continuation token for you. The Get-PowerBIActivityEvent cmdlet takes a StartDateTime and an EndDateTime parameter with the same restrictions as the ActivityEvents REST API. In other words, the start date and end date must reference the same date value because you can only retrieve the activity data for one day at a time.

The following script demonstrates how to download all Power BI activities. The command converts the results from JSON into .NET objects for straightforward access to individual activity properties. These examples show the smallest and largest timestamps possible for a day to ensure no events are missed.

Login-PowerBI

$activities = Get-PowerBIActivityEvent -StartDateTime '2019-08-31T00:00:00' -EndDateTime '2019-08-31T23:59:59' | ConvertFrom-Json

$activities.Count
$activities[0]

Filter activity data

You can filter activity events by activity type and user ID. The following script demonstrates how to download only the event data for the ViewDashboard activity. For additional information about supported parameters, use the command Get-Help Get-PowerBIActivityEvent.

Login-PowerBI

$activities = Get-PowerBIActivityEvent -StartDateTime '2019-08-31T00:00:00' -EndDateTime '2019-08-31T23:59:59' -ActivityType 'ViewDashboard' | ConvertFrom-Json

$activities.Count
$activities[0]

Use the audit log

If your task is to track user activities across Power BI and Microsoft 365, you work with auditing in Microsoft 365 compliance or use PowerShell. Auditing relies on functionality in Exchange Online, which automatically supports Power BI.

You can filter the audit data by date range, user, dashboard, report, dataset, and activity type. You can also download the activities in a csv (comma-separated value) file to analyze offline.

Audit log requirements

Meet these requirements to access audit logs:

• You must either be a global admin or assigned the Audit Logs or View-Only Audit Logs role in Exchange Online to access the audit log. By default, the Compliance Management and Organization Management role groups have roles assigned on the Permissions page in the Exchange admin center. For more information about the roles that can view audit logs, see Requirements to search the audit log.

  To give non-admin accounts access to the audit log, add the user as a member of one of these role groups. Another option is to create a custom role group in the Exchange admin center, assign the Audit Logs or View-Only Audit Logs role to this group, and then add the non-admin account to the new role group. For more information, see Manage role groups in Exchange Online.

  If you can't access the Exchange admin center from the Microsoft 365 admin center, go to https://outlook.office365.com/ecp and sign in using your credentials.

• If you have access to the audit log but aren't a global admin or Power BI Administrator, you can't get to the Power BI Admin portal. In this case, use a direct link to Microsoft 365 compliance.

Access your audit logs

To access logs, first enable logging in Power BI. For more information, see Audit and usage settings in the admin portal documentation. There may be up to a 48-hour delay between the time you enable auditing and when you can view audit data. If you don't see data immediately, check the audit logs later. You might experience a similar delay between getting permission to view audit logs and being able to access the logs.

The Power BI audit logs are available directly through Microsoft 365 compliance. There's also a link from the Power BI admin portal:

1. In Power BI, select Settings > Admin portal.

   

2. Select Audit logs.

3. Select Go to Microsoft 365 Admin Center.

   

Search Power BI activities

Search for Power BI activities by following these steps. For a list of activities, see the list of activities audited by Power BI later in this article.

1. On the Audit page, under Search, select the drop-down for Activities.

2. Enter Power BI to go to the list of Power BI activities.

   

3. Select each of the Power BI activities that you want to track.

Your search will only return the selected Power BI activities.

Search the audit logs by date

You can search the logs by date range using the Start date and End date fields. The default selection is the past seven days. The display presents the date and time in Coordinated Universal Time (UTC) format. The maximum date range that you can specify is 90 days.

You'll receive an error if the selected date range is greater than 90 days. If you're using the maximum date range of 90 days, select the current time for Start date. Otherwise, you'll receive an error saying that the start date is earlier than the end date. If you've turned on auditing within the last 90 days, the date range can't start before the date that auditing was turned on.

Search the audit logs by users

You can search for audit log entries for activities done by specific users. Enter one or more user names in the Users field. The user name looks like an email address. Leave this box blank to return entries for all users (and service accounts) in your organization.

Search the audit logs by file, folder, or site

If you're trying to determine who accessed a file, folder, or site, on the Audit page, enter all or part of a file name, folder name, or URL in the File, folder, or site field. Don't use any spaces or special characters. For example, you can enter all or part of the name of a dataset to find who has interacted with it recently.

In the example shown below, the search term "sales" was entered in the File, folder, or site field.

The search results for the "sales" filter show user activity for the Contoso Q2 Division Sales dataset.

Combine filters to narrow results

You can combine any of the filters included on the Audit page to refine the results that are returned. When you combine filters, the search results will show only items that match all of the filter criteria.

View search results

After you select Search, the search results load and display on the Audit search page. When the search finishes, the display shows the number of results found. Audit search displays a maximum of 1000 events. If more than 1000 events meet the search criteria, the app displays the newest 1000 events.

The following information is shown for each event returned by the search. Select a column header under Results to sort the results.

View the details for an event

To view more details about an event, select the event record in the list of search results. A Detail page appears that has the detailed properties from the event record. The Detail page displays properties depending on the Microsoft 365 service in which the event occurs.

All Power BI entries have a value of 20 for the RecordType property. For information about other properties, see Detailed properties in the audit log.

Export search results

To export the Power BI audit log search results to a CSV file, follow these steps.

1. Do an audit search by following the steps in this article.

2. On the Audit search results page, select the drop-down next to Export, then select Download all results. The results are saved in CSV format and the file can be found in the user's Downloads folder.

   

Use PowerShell to search audit logs

You can also use PowerShell to access the audit logs. The following example shows how to connect to Exchange Online PowerShell V2 (EXO V2) and then use the Search-UnifiedAuditLog command to pull Power BI audit log entries. To run the script, an admin must assign you the appropriate permissions, as described in the Audit log requirements section. Read About the Exchange Online PowerShell V2 module and Connect to Exchange Online PowerShell to learn more about how this PowerShell module works.

You can download the EXO V2 module from the PowerShell gallery at https://www.powershellgallery.com/packages/ExchangeOnlineManagement/.

#The first command sets the execution policy for Windows computers and allows scripts to run.
Set-ExecutionPolicy RemoteSigned

#The following command loads the Exchange Online management module.
Import-Module ExchangeOnlineManagement

#Next, you connect using your user principal name. A dialog will prompt you for your password and any multi-factor authentication requirements.
Connect-ExchangeOnline -UserPrincipalName <user@contoso.com>

#Now you can query for Power BI activity. In this example, the results are limited to 1,000, shown as a table, and the "more" command causes output to display one screen at a time. 
Search-UnifiedAuditLog -StartDate 09/16/2021 -EndDate 9/23/2021 -RecordType PowerBIAudit -ResultSize 1000 | Format-Table | More

Use PowerShell to export audit logs

You can also use PowerShell to export the results of your audit logs search. The following example shows how to send from the Search-UnifiedAuditLog command, and export the results using the Export-Csv cmdlet. To run the script, an admin must assign you the appropriate permissions, as described in the Audit log requirements section.

Set-ExecutionPolicy RemoteSigned

Import-Module ExchangeOnlineManagement
Connect-ExchangeOnline -UserPrincipalName <user@contoso.com>
Search-UnifiedAuditLog -StartDate 09/16/2021 -EndDate 9/23/2021 -RecordType PowerBIAudit -ResultSize 1000 | Export-Csv -Path "c:\temp\PowerBIAuditLog.csv" -NoTypeInformation

For more information on connecting to Exchange Online, see Connect to Exchange Online PowerShell. For another example of using PowerShell with audit logs, see Using Power BI audit log and PowerShell to assign Power BI Pro licenses.

Operations available in the audit and activity logs

The following operations are available in both the audit and activity logs.

¹ Publishing from Power BI Desktop to the service is a CreateReport event in the service.

² PublishToWebReport refers to the Publish to web feature.

³ UpdateFeaturedTables refers to Power BI featured tables in Excel.

Next steps

• What is Power BI administration?
• Power BI Admin Portal
• Access the Power BI activity log
• Questions? Try asking the Power BI Community
• Suggestions? Contribute ideas to improve Power BI