Get-AzureAdAuditSigninLogs -Filter syntax error

PowerShell Help
1

Hello, I have constructed an Azure PowerShell query to get Sign-Ins for all Applications and want to use two of the Filters in one line, so I chose -ADD, but get an error:

Get-AzureAdAuditSigninLogs : Error occurred while executing GetAuditSignInLogs
Code: BadRequest
Message: Invalid filter clause

Help says -Filter wants a String so not sure what I’m doing wrong here

$Import = Import-CSV "Fl_UsersSignIns.csv"
$Results = @()
Foreach ($Entry in $Import) {
    $UPN = $Entry.DisplayName
    $AzureResults = Get-AzureAdAuditSigninLogs -Filter "'userprincipalname eq $UPN' -AND 'createdDateTime gt 2021-08-23'" -Top 1
    $Update = [PSCustomObject]@{
        Name               = $Entry.Name
        UserPrincipalName  = $UPN
        AppDisplayName     = $AzureResults.AppDisplayName
        ClientAppUsed      = $AzureResults.ClientAppUsed
        Manager            = $Entry.Manager
        ADLastLogonDate    = $Entry.LastLogonDate
        AzureLastLogonDate = $AzureResults.CreatedDateTime
        EmployeeStatus  = $Entry.EmployeeStatus
        LocationCode    = $Entry.LocationCode
    }
}
$Results += $Update
Write-Output $Update
$Results | Export-CSV "Azure_SignIns.csv" -NoTypeInformation

Thank you

2

I don’t have experiences with Azure PowerShell but when the -Filter parameter works a little bit similar to the -Filter parameter of - for example - Get-ADUser it should be a little more like this I think:

$Import = Import-CSV "Fl_UsersSignIns.csv"
$Results = 
Foreach ($Entry in $Import) {
    $UPN = $Entry.DisplayName
    $AzureResults = Get-AzureAdAuditSigninLogs -Filter "userprincipalname -eq '$UPN' -AND createdDateTime -gt '2021-08-23'" -Top 1
    [PSCustomObject]@{
        Name               = $Entry.Name
        UserPrincipalName  = $UPN
        AppDisplayName     = $AzureResults.AppDisplayName
        ClientAppUsed      = $AzureResults.ClientAppUsed
        Manager            = $Entry.Manager
        ADLastLogonDate    = $Entry.LastLogonDate
        AzureLastLogonDate = $AzureResults.CreatedDateTime
        EmployeeStatus     = $Entry.EmployeeStatus
        LocationCode       = $Entry.LocationCode
    }
}
$Results | 
Export-CSV "Azure_SignIns.csv" -NoTypeInformation

Did you try to use only one filter criteria at a time? Does it work then?

3

If I try the single cmdlet, I do see an error with the PSCustomObject section…

$Import = Import-CSV "FL_UsersNotRegistered.csv"
$Results = @()
Foreach ($Entry in $Import) {​
    $AzureLastLogonDate = (Get-AzureAdAuditSigninLogs -Top 1 -Filter "userprincipalname eq '$($Entry.UserPrincipalName)'" | Select-Object CreatedDateTime).CreatedDateTime
    $Update = [PSCustomObject]@{
        Name               = $Entry.Name
        Manager            = $Entry.Manager
        ADLastLogonDate    = $Entry.LastLogonDate
        AzureLastLogonDate = $AzureLastLogonDate
        EmployeeStatus  = $Entry.EmployeeStatus
        LocationCode    = $Entry.LocationCode
        }​
    }
    $Results += $Update
    Write-Output $Update
$Results | Export-CSV "Azure login Results_FL.csv" -NoTypeInformation


At line:12 char:10
+         }​
+          ~
Unexpected token '​' in expression or statement.
    + CategoryInfo          : ParserError: (:) [], ParentContainsErrorRecordException
    + FullyQualifiedErrorId : UnexpectedToken
4

First - when you get errors you should post them completely formatted as code.
Second - what did you try to solve it?
Third - does that mean that the query is actually working?

$Import = Import-CSV '.\FL_UsersNotRegistered.csv'
$Results = @(
    Foreach ($Entry in $Import) {
        $AzureLastLogonDate = 
            Get-AzureAdAuditSigninLogs -Top 1 -Filter "userprincipalname eq '$($Entry.UserPrincipalName)'"
        [PSCustomObject]@{
            Name               = $Entry.Name
            Manager            = $Entry.Manager
            ADLastLogonDate    = $Entry.LastLogonDate
            AzureLastLogonDate = $AzureLastLogonDate.CreatedDateTime
            EmployeeStatus     = $Entry.EmployeeStatus
            LocationCode       = $Entry.LocationCode
        }
    }
)
$Results | Export-CSV '.\Azure login Results_FL.csv' -NoTypeInformation
$Results
5

First - Edited.
Second - Attempted your first suggestion; reduce to one cmdlet
Third - No, new error but probably related to the formatting of the PSCustomObject?

6

Errors are an important feature. They tell you what’s wrong and sometimes they even tell you what to change. If you get errors share them!!

Did you try the last version I posted? … and you may try it like I posted it. :point_up_2:t4: :smirk:

7

Yep tried your code thus:

$Import = Import-CSV "Fl_UsersSignIns.csv"
$Results = 
Foreach ($Entry in $Import) {
    $UPN = $Entry.DisplayName
    $AzureResults = Get-AzureAdAuditSigninLogs -Filter "userprincipalname -eq '$UPN' -AND createdDateTime -gt '2021-08-23'" -Top 1
    [PSCustomObject]@{
        UserPrincipalName  = $UPN
        AppDisplayName     = $AzureResults.AppDisplayName
        ClientAppUsed      = $AzureResults.ClientAppUsed
        AzureLastLogonDate = $AzureResults.CreatedDateTime
    }
}
$Results | 
Export-CSV "Azure_SignIns_FL.csv" -NoTypeInformation

Get-AzureAdAuditSigninLogs : Error occurred while executing GetAuditSignInLogs 
Code: BadRequest
Message: Invalid filter clause

yet, I do get results. Just don’t like all the errors as it processes each.

8

Do you get also get errors when you use only one of the parts of your filter? So either this:

$AzureResults = Get-AzureAdAuditSigninLogs -Filter "userprincipalname -eq '$UPN'" -Top 1

or this:

$AzureResults = Get-AzureAdAuditSigninLogs -Filter "createdDateTime -gt '2021-08-23'" -Top 1

Another idea: you may consider to query all logins after a certain time and compare it against your CSV data with Compare-Object at once.

9

Yes, same exact error for both examples

Get-AzureAdAuditSigninLogs : Error occurred while executing GetAuditSignInLogs 
Code: BadRequest
Message: Invalid filter clause
10

Ooops … reviewing the help again I just noticed that the comparison operators in fact do not have a dash in front of it. So you may try again this way …

$Import = Import-CSV "Fl_UsersSignIns.csv"
$Results = 
Foreach ($Entry in $Import) {
    $UPN = $Entry.DisplayName
    $AzureResults = Get-AzureAdAuditSigninLogs -Filter "userprincipalname eq '$UPN' -AND createdDateTime gt '2021-08-23'" -Top 1
    [PSCustomObject]@{
        UserPrincipalName  = $UPN
        AppDisplayName     = $AzureResults.AppDisplayName
        ClientAppUsed      = $AzureResults.ClientAppUsed
        AzureLastLogonDate = $AzureResults.CreatedDateTime
    }
}
$Results | 
Export-CSV "Azure_SignIns_FL.csv" -NoTypeInformation