Question

我尝试为我们所有的Azure帐户运行登录报告，我去了Azure AD，并且->登录->下载，下载了PowerShell脚本并成功获取了数据。但是，它产生了太多的细节。 URL = https://graph.microsoft.com/beta/auditLogs/signIns？

我跑了7天，生成了超过1亿个txt数据，我只是在寻找所有ID和createdDateTime用户的signIns报告。

如何更改导出数据？我是这个Graph Explorer的新手，如果您有任何想法和建议，请告诉我，谢谢。

{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#auditLogs/signIns",
    "value": [
        {
            "id": "",
            "createdDateTime": "2018-11-20T00:12:09.3961159Z",
            "userDisplayName": "",
            "userPrincipalName": ".com",
            "userId": "",
            "appId": "",
            "appDisplayName": "Graph explorer",
            "ipAddress": "",
            "clientAppUsed": "Browser",
            "mfaDetail": null,
            "correlationId": "",
            "conditionalAccessStatus": null,
            "originalRequestId": null,
            "isInteractive": true,
            "tokenIssuerName": null,
            "tokenIssuerType": "AzureAD",
            "processingTimeInMilliseconds": 0,
            "riskDetail": "hidden",
            "riskLevelAggregated": "hidden",
            "riskLevelDuringSignIn": "hidden",
            "riskState": "none",
            "riskEventTypes": [],
            "resourceDisplayName": "microsoft graph",
            "resourceId": "00000003-0000-0000-c000-000000000000",
            "authenticationMethodsUsed": [],

}

Answer 1

我只是在寻找ID为和的所有用户的登录报告仅限createdDateTime

在Microsoft Graph Api中，查询$select=id,createdDateTime可以使您所需，但 signIns 不支持select，而其他supported query无法做到这一点。

microsoft-graph Azure AD登录预览日志修改

1 个答案: