Get-MgBetaAuditLogSignIn

Module:

Microsoft.Graph.Beta.Reports

Get a signIn object that contains a specific user sign-in event for your tenant that includes sign-ins where a user is asked to enter a username or password, and session tokens.

Note

To view the v1.0 release of this cmdlet, view Get-MgAuditLogSignIn

Syntax

Get-MgBetaAuditLogSignIn
   [-ExpandProperty <String[]>]
   [-Property <String[]>]
   [-Filter <String>]
   [-Search <String>]
   [-Skip <Int32>]
   [-Sort <String[]>]
   [-Top <Int32>]
   [-ResponseHeadersVariable <String>]
   [-Headers <IDictionary>]
   [-PageSize <Int32>]
   [-All]
   [-CountVariable <String>]
   [-ProgressAction <ActionPreference>]
   [<CommonParameters>]

Get-MgBetaAuditLogSignIn
   -SignInId <String>
   [-ExpandProperty <String[]>]
   [-Property <String[]>]
   [-ResponseHeadersVariable <String>]
   [-Headers <IDictionary>]
   [-ProgressAction <ActionPreference>]
   [<CommonParameters>]

Get-MgBetaAuditLogSignIn
   -InputObject <IReportsIdentity>
   [-ExpandProperty <String[]>]
   [-Property <String[]>]
   [-ResponseHeadersVariable <String>]
   [-Headers <IDictionary>]
   [-ProgressAction <ActionPreference>]
   [<CommonParameters>]

Description

Get a signIn object that contains a specific user sign-in event for your tenant that includes sign-ins where a user is asked to enter a username or password, and session tokens.

Examples

Example 1: List all sign-ins

Import-Module Microsoft.Graph.Beta.Reports

Get-MgBetaAuditLogSignIn

This example will list all sign-ins

Example 2: Retrieve the first 10 sign-ins to apps with the appDisplayName that starts with 'Azure'

Import-Module Microsoft.Graph.Beta.Reports

Get-MgBetaAuditLogSignIn -Filter "startsWith(appDisplayName,'Azure')" -Top 10

This example will retrieve the first 10 sign-ins to apps with the appdisplayname that starts with 'azure'

Example 3: Retrieve the first 10 sign-ins where the signInEventType is not interactiveUser starting with the latest sign-in

Import-Module Microsoft.Graph.Beta.Reports

Get-MgBetaAuditLogSignIn -Filter "(signInEventTypes/any(t: t ne 'interactiveUser'))" -Sort "createdDateTime DESC" -Top 10

This example will retrieve the first 10 sign-ins where the signineventtype is not interactiveuser starting with the latest sign-in

Parameters

-All

List all pages.

Type:	SwitchParameter
Position:	Named
Default value:	False
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-CountVariable

Specifies a count of the total number of items in a collection. By default, this variable will be set in the global scope.

Type:	String
Aliases:	CV
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-ExpandProperty

Expand related entities

Type:	String[]
Aliases:	Expand
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-Filter

Filter items by property values

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-Headers

Optional headers that will be added to the request.

Type:	IDictionary
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	True
Accept wildcard characters:	False

-InputObject

Identity Parameter To construct, see NOTES section for INPUTOBJECT properties and create a hash table.

Type:	IReportsIdentity
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	True
Accept wildcard characters:	False

-PageSize

Sets the page size of results.

Type:	Int32
Position:	Named
Default value:	0
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-ProgressAction

{{ Fill ProgressAction Description }}

Type:	ActionPreference
Aliases:	proga
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-Property

Select properties to be returned

Type:	String[]
Aliases:	Select
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-ResponseHeadersVariable

Optional Response Headers Variable.

Type:	String
Aliases:	RHV
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-Search

Search items by search phrases

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-SignInId

The unique identifier of signIn

Type:	String
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	False
Accept wildcard characters:	False

-Skip

Skip the first n items

Type:	Int32
Position:	Named
Default value:	0
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-Sort

Order items by property values

Type:	String[]
Aliases:	OrderBy
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-Top

Show only the first n items

Type:	Int32
Aliases:	Limit
Position:	Named
Default value:	0
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

Inputs

Microsoft.Graph.Beta.PowerShell.Models.IReportsIdentity

System.Collections.IDictionary

Outputs

Microsoft.Graph.Beta.PowerShell.Models.IMicrosoftGraphSignIn

Notes

COMPLEX PARAMETER PROPERTIES

To create the parameters described below, construct a hash table containing the appropriate properties. For information on hash tables, run Get-Help about_Hash_Tables.

INPUTOBJECT <IReportsIdentity>: Identity Parameter

• [ActiveUsersBreakdownMetricId <String>]: The unique identifier of activeUsersBreakdownMetric
• [ActiveUsersMetricId <String>]: The unique identifier of activeUsersMetric
• [AppCredentialSignInActivityId <String>]: The unique identifier of appCredentialSignInActivity
• [ApplicationSignInDetailedSummaryId <String>]: The unique identifier of applicationSignInDetailedSummary
• [AuthenticationsMetricId <String>]: The unique identifier of authenticationsMetric
• [CredentialUserRegistrationDetailsId <String>]: The unique identifier of credentialUserRegistrationDetails
• [CustomSecurityAttributeAuditId <String>]: The unique identifier of customSecurityAttributeAudit
• [DailyInactiveUsersByApplicationMetricId <String>]: The unique identifier of dailyInactiveUsersByApplicationMetric
• [DailyInactiveUsersMetricId <String>]: The unique identifier of dailyInactiveUsersMetric
• [Date <DateTime?>]: Usage: date={date}
• [DeviceManagementCachedReportConfigurationId <String>]: The unique identifier of deviceManagementCachedReportConfiguration
• [DeviceManagementExportJobId <String>]: The unique identifier of deviceManagementExportJob
• [DirectoryAuditId <String>]: The unique identifier of directoryAudit
• [EndDateTime <DateTime?>]: Usage: endDateTime={endDateTime}
• [ExclusiveIntervalEndDateTime <DateTime?>]: Usage: exclusiveIntervalEndDateTime={exclusiveIntervalEndDateTime}
• [Filter <String>]: Usage: filter='{filter}'
• [GroupId <String>]: Usage: groupId='{groupId}'
• [IncludedUserRoles <String>]: Usage: includedUserRoles='{includedUserRoles}'
• [IncludedUserTypes <String>]: Usage: includedUserTypes='{includedUserTypes}'
• [InclusiveIntervalStartDateTime <DateTime?>]: Usage: inclusiveIntervalStartDateTime={inclusiveIntervalStartDateTime}
• [InsightSummaryId <String>]: The unique identifier of insightSummary
• [ManifestId <String>]: The unique identifier of manifest
• [MfaCompletionMetricId <String>]: The unique identifier of mfaCompletionMetric
• [MonthlyInactiveUsersByApplicationMetricId <String>]: The unique identifier of monthlyInactiveUsersByApplicationMetric
• [MonthlyInactiveUsersMetricId <String>]: The unique identifier of monthlyInactiveUsersMetric
• [OperationId <String>]: The unique identifier of operation
• [Period <String>]: Usage: period='{period}'
• [PrintUsageByPrinterId <String>]: The unique identifier of printUsageByPrinter
• [PrintUsageByUserId <String>]: The unique identifier of printUsageByUser
• [PrintUsageId <String>]: The unique identifier of printUsage
• [PrinterId <String>]: Usage: printerId='{printerId}'
• [ProvisioningObjectSummaryId <String>]: The unique identifier of provisioningObjectSummary
• [ServicePrincipalSignInActivityId <String>]: The unique identifier of servicePrincipalSignInActivity
• [SignInId <String>]: The unique identifier of signIn
• [Skip <Int32?>]: Usage: skip={skip}
• [SkipToken <String>]: Usage: skipToken='{skipToken}'
• [StartDateTime <DateTime?>]: Usage: startDateTime={startDateTime}
• [Top <Int32?>]: Usage: top={top}
• [UserCountMetricId <String>]: The unique identifier of userCountMetric
• [UserCredentialUsageDetailsId <String>]: The unique identifier of userCredentialUsageDetails
• [UserId <String>]: Usage: userId='{userId}'
• [UserRegistrationDetailsId <String>]: The unique identifier of userRegistrationDetails
• [UserRequestsMetricId <String>]: The unique identifier of userRequestsMetric
• [UserSignUpMetricId <String>]: The unique identifier of userSignUpMetric

Related Links

• https://learn.microsoft.com/powershell/module/microsoft.graph.beta.reports/get-mgbetaauditlogsignin
• https://learn.microsoft.com/graph/api/signin-get?view=graph-rest-1.0
• https://learn.microsoft.com/graph/api/signin-list?view=graph-rest-1.0