Get-AzureADAuditSignInLogs

by
Azure AD sign-in logs PowerShell

This article will discuss how to get sign-in logs in Azure Active Directory using the PowerShell command Get-AzureADAuditSignInLogs.

Get-AzureADAuditSignInLogs

Get-AzureADAuditSignInLogs is an excellent Azure PowerShell cmdlet that can help you retrieve the sign-in logs in Azure Active Directory. Let’s discuss the syntax of the Get-AzureADAuditSignInLogs Azure PowerShell cmdlet with examples.

Syntax

Get-AzureADAuditSignInLogs

If you want to add any filter condition, you can use the syntax like this.

Get-AzureADAuditSignInLogs -Filter "fliter condition as a string"

Example:

Below, the Azure PowerShell cmdlet will get you the sign-in logs from your Azure Active Directory.

Get-AzureADAuditSignInLogs

After executing the above Azure PowerShell cmdlet, I got the below error

“Get-AzureADAuditSignInLogs: The term ‘Get-AzureADAuditSignInLogs’ is not recognized
as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and
try again.”

Below is the complete error message

Get-AzureADAuditSignInLogs : The term 'Get-AzureADAuditSignInLogs' is not recognized 
as the name of a cmdlet, function, script file, or operable program. Check the 
spelling of the name, or if a path was included, verify that the path is correct and 
try again.
At line:1 char:1
+ Get-AzureADAuditSignInLogs
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-AzureADAuditSignInLogs:String) [], 
    CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException

You can see it here.

get-azureadauditsigninlogs not recognized

Solution

To solve the error “get-azureadauditsigninlogs’ is not recognized as the name of a cmdlet”, I followed the below steps.

  • Uninstall the Azure AD module using the below PowerShell cmdlet.
Uninstall-Module azuread

Now, install the AzureADPreview module using the below PowerShell cmdlet.

Install-Module AzureADPreview
Get -AzureADAuditSignInLogs is not recognized

After installing the AzureADPreview module, I reran the Get-AzureADAuditSignInLogs Azure PowerShell cmdlet. But this time, I got the error

Get-AzureADAuditSignInLogs : You must call the Connect-AzureAD cmdlet before calling
any other cmdlets.

the term 'get-azureadauditsigninlogs' is not recognized as the name of a cmdlet

So, I tried running the Connect-AzureAD followed by the Get-AzureADAuditSignInLogs Azure PowerShell cmdlet.

Connect-AzureAD
Get-AzureADAuditSignInLogs

After executing the Get-AzureADAuditSignInLogs, a few people are getting the below error, and this error is because of a lack of MSGraph permissions.

Get-AzureADAuditSignInLogs : Error occurred while executing GetAuditSignInLogs
Code: Authentication_MSGraphPermissionMissing
Message: Calling principal does not have required MSGraph permissions

The complete error message is

Get-AzureADAuditSignInLogs : Error occurred while executing GetAuditSignInLogs
Code: Authentication_MSGraphPermissionMissing
Message: Calling principal does not have required MSGraph permissions
AuditLog.Read.All
InnerError:
RequestId: 51b5d58d-3362-4535-9281-b503783f5647
DateTimeStamp: Fri, 09 Sep 2022 12:06:46 GMT
HttpStatusCode: Forbidden
HttpStatusDescription: Forbidden
HttpResponseStatus: Completed
At line:2 char:1

  • Get-AzureADAuditSignInLogs
  • ~~~~~~
    • CategoryInfo : NotSpecified: (:) [Get-AzureADAuditSignInLogs], ApiExce
      ption
    • FullyQualifiedErrorId: Microsoft.Open.MSGraphBeta.Client.ApiException,Microsof
      t.Open.MSGraphBeta.PowerShell.GetAuditSignInLogs

You can see it here

the term 'get-azureadauditsigninlogs' is not recognized as the name of a cmdlet

If you are getting the above error, follow this article to solve this error.

You may also like following the articles below

Final Words

In this article, we discussed how to get sign-in logs in Azure Active Directory using PowerShell and Azure Portal. Thanks for reading this article.