Microsoft Graph PowerShell cmdlets for Microsoft Entra monitoring and health

With Microsoft Entra monitoring and health, you can get details on activities around all the write operations in your directory (audit logs) and authentication data (sign-in logs). Although the information is available by using the Microsoft Graph API, now you can retrieve the same data by using the Microsoft Graph PowerShell cmdlets for Identity monitoring and health.

This article gives you an overview of the Microsoft Graph PowerShell cmdlets to use for audit logs and sign-in logs. Get started with Microsoft Graph PowerShell.

Audit logs provide traceability through logs for all changes done by various features within Microsoft Entra ID. Examples of audit logs include changes made to any resources within Microsoft Entra ID like adding or removing users, apps, groups, roles, and policies.

You get access to the audit logs using the Get-MgAuditLogDirectoryAudit cmdlet.

The sign-ins logs provide information about the usage of managed applications and user sign-in activities.

You get access to the sign-in logs using the Get-MgAuditLogSignIn cmdlet. Use the following table for more scenarios.

• Analyze activity logs with Microsoft Graph