Question

我使用MSGraph Explorer和PowerShell Invoke-RestMethod来查询相同的MSGraph API，但是MSGraph Explorer返回的详细信息比PowerShell命令更多。这可能是权限问题，还是我在PowerShell命令中错过了某些内容。

这里是URI，用于检索特定目录更改的审核日志。

cat

这是MSGraph Explorer的输出：

https://graph.microsoft.com/beta/auditLogs/directoryAudits/Directory_029A8_49125229

这是Invoke-RestMethod的输出：

{
    "@odata.context": "https://graph.microsoft.com/beta/$metadata#auditLogs/directoryAudits/$entity",
    "id": "Directory_029A8_49125229",
    "category": "Core Directory",
    "correlationId": "d534994f-61f4-4015-8040-c16f728ec8b3",
    "result": "success",
    "resultReason": "",
    "activityDisplayName": "Update user",
    "activityDateTime": "2018-10-04T05:41:19.9668303Z",
    "loggedByService": null,
    "initiatedBy": {
        "app": null,
        "user": {
            "id": "1f5c2159-f515-4cea-a99c-11c6ce1f7a5e",
            "displayName": null,
            "userPrincipalName": "tom-admin@contoso.onmicrosoft.com",
            "ipAddress": "<null>"
        }
    },
    "targetResources": [
        {
            "@odata.type": "#microsoft.graph.targetResourceUser",
            "id": "498b3884-f723-444c-9c01-b75ec2c0ef08",
            "displayName": null,
            "userPrincipalName": "Tom.Real@contoso.com",
            "modifiedProperties": [
                {
                    "displayName": "AssignedLicense",
                    "oldValue": "[\"[SkuName=ENTERPRISEPACK, AccountId=cdc4b90d-7fa9-4a, SkuId=6f94b900, DisabledPlans=[]]\"]",
                    "newValue": "[]"
                },
                {
                    "displayName": "AssignedPlan",
                    "oldValue": "[{\"SubscribedPlanId\":..., \"ServicePlanId\":\"50e68c76-46c6-4674-81f9-75456511b170\"}]",
                    "newValue": "[{\"SubscribedPlanId\":... 50e68c76-46c6-4674-81f9-75456511b170\"}]"
                },
                {
                    "displayName": "Included Updated Properties",
                    "oldValue": null,
                    "newValue": "\"AssignedLicense, AssignedPlan\""
                },
                {
                    "displayName": "TargetId.UserType",
                    "oldValue": null,
                    "newValue": "\"Member\""
                }
            ]
        }
    ],
    "additionalDetails": [
        {
            "key": "UserType",
            "value": "Member"
        }
    ]
}

如您所见，Invoke-RestMethod不会在“ additionalDetails”下返回任何详细信息。

这是我的PowerShell脚本

{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#auditLogs/directoryAudits/$entity",
"id": "Directory_029A8_49125229",
"category": "Core Directory",
"correlationId": "d534994f-61f4-4015-8040-c16f728ec8b3",
"result": "success",
"resultReason": "",
"activityDisplayName": "Update user",
"activityDateTime": "2018-10-04T05:41:19.9668303Z",
"loggedByService": null,
"initiatedBy": {
"app": null,
"user": {
"id": "1f5c2159-f515-4cea-a99c-11c6ce1f7a5e",
"displayName": null,
"userPrincipalName": "tom-admin@contoso.onmicrosoft.com",
"ipAddress": "\u003cnull\u003e"
}
},
"targetResources": [
{
"@odata.type": "#microsoft.graph.targetResourceUser",
"id": "498b3884-f723-444c-9c01-b75ec2c0ef08",
"displayName": null,
"userPrincipalName": "Tom.Real@contos.com",
"modifiedProperties": " "
}
],
"additionalDetails": [
{
"key": "UserType",
"value": "Member"
}
]
}

Answer 1

我相信您的查询和权限一切都很好，结果有所不同，因为对于ConvertTo-Json cmdlet 默认，JSON表示中包含2级包含的对象。

因此，如果您希望directoryAudit的所有属性都包含在结果中，则需要显式指定Depth参数，例如：

$results |ConvertTo-Json -Depth 3   #at least 3 levels for directoryAudit entry

使用PowerShell Invoke-RestMethod查询MSGraph API不会返回与MSGraph Explorer相同数量的详细信息

1 个答案: