Get-AipServiceTrackingLog

Gets tracking information for documents protected by Azure Information Protection.

This cmdlet is supported by both the Azure Information Protection classic and unified labeling clients, with different usage, as described below.

Note

Track and revoke features for the unified labeling client are currently in PREVIEW. The Azure Preview Supplemental Terms include additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.

Syntax

Get-AipServiceTrackingLog
   -ContentId <Guid>
   [-FromTime <DateTime>]
   [-ToTime <DateTime>]
   [-WhatIf]
   [-Confirm]
   [<CommonParameters>]
Get-AipServiceTrackingLog
   -UserEmail <String>
   [-FromTime <DateTime>]
   [-ToTime <DateTime>]
   [-WhatIf]
   [-Confirm]
   [<CommonParameters>]

Description

The Get-AipServiceTrackingLog cmdlet runs a query to return protection information about tracked documents.

Information returned includes:

  • The document content ID, with the document name if available.
  • The Rights Management issuer.
  • The users who accessed the document, when, and from what location.
  • What protection template ID or specific usage rights were used to protect the document and whether access was granted or denied.

You can specify a start time and stop time of entries to include. The output is returned as a list of PowerShell objects in the PowerShell console.

Unified labeling client

The Get-AipServiceTracking cmdlet returns tracking information about a protected document with a specified contentID.

To retrieve the contentID for a specific document, use the Get-AipServiceDocumentLog cmdlet.

Classic client

The Get-AipServiceTrackingLog cmdlet returns tracking information about protected documents for a specified user who protected documents (the Rights Management issuer) or who accessed protected documents. This cmdlet helps to answer the question "Which protected documents did a specified user track or access?"

You can alternatively use the document tracking site to get the protection information about the tracked documents. For more information, see the Tracking and revoking documents for users section in the admin guide.

Examples

Example 1: (Unified labeling client only) Get tracking data for a specific document, using its contentId

PS C:\>Get-AipServiceDocumentLog -ContentId c03bf90c-6e40-4f3f-9ba0-2bcd77524b87

This command runs a query to return tracking information for a specific document, with a contentID value of c03bf90c-6e40-4f3f-9ba0-2bcd77524b87

Example 2: (Classic client only) Get all tracking information for a user

PS C:\>Get-AipServiceTrackingLog -UserEmail "test@contoso.com"

This command generates a log of all the tracking information for documents that were protected by or accessed by the user with the email address "test@contoso.com".

Example 3: (Classic client only) Get tracking information for a user, for a specific time period

PS C:\>Get-AipServiceTrackingLog -UserEmail "test@contoso.com" -FromTime "01/01/2018 00:00:00" -ToTime "01/31/2018 23:59:59"

This command is the same as the previous example except that the results are limited to documents that were tracked within a specific time period by using the FromTime and ToTime parameters. In this example, the time period is all days in January 2018, using the US date format.

Example 4: (Classic client only) Get all tracking information for a user and save the results to a .csv file

PS C:\>$trackingLogs = Get-AipServiceTrackingLog -UserEmail "test@contoso.com"
PS C:\>$trackingLogs | Export-Csv 'C:\Temp\TrackingLog.csv' -NoTypeInformation

The first command generates a log of all the tracking information for documents that were protected by or accessed by the user with the email address "test@contoso.com", and saves the result in a variable.

The second command then uses the Export-Csv cmdlet to convert the tracking information into .csv format, and saves it to the C:\Temp\TrackingLog.csv file.

Parameters

-Confirm

Prompts you for confirmation before running the cmdlet.

Type:SwitchParameter
Aliases:cf
Position:Named
Default value:None
Accept pipeline input:False
Accept wildcard characters:False
-ContentId

Specifies the contentID value for the document you want to return tracking data for.

To retrieve the contentID for a specific document, use the Get-AipServiceDocumentLog cmdlet.

Type:String
Aliases:cf
Position:Named
Default value:None
Accept pipeline input:False
Accept wildcard characters:False
-FromTime

Specifies the start time (inclusive) for the log file as a DateTime object. To obtain a DateTime object, use the Get-Date cmdlet. Specify the date and time according to your system locale settings. For more information, type Get-Help Get-Date.

Type:DateTime
Position:Named
Default value:None
Accept pipeline input:False
Accept wildcard characters:False
-ToTime

Specifies the stop time (inclusive) for the log file as a DateTime object. To obtain a DateTime object, use the Get-Date cmdlet. Specify the date and time according to your system locale settings. For more information, type Get-Help Get-Date.

Type:DateTime
Position:Named
Default value:None
Accept pipeline input:False
Accept wildcard characters:False
-UserEmail

Specifies the email address of the user. The cmdlet gets the tracking information for documents that were protected by, or accessed by the user who has this email address.

Type:String
Position:Named
Default value:None
Accept pipeline input:True
Accept wildcard characters:False
-WhatIf

Shows what would happen if the cmdlet runs. The cmdlet is not run.

Type:SwitchParameter
Aliases:wi
Position:Named
Default value:None
Accept pipeline input:False
Accept wildcard characters:False