Skip to content

Commit ab376f3

Browse files
SteveMutungi254SteveMutungi254
authored
Additional scenarios based on product group engagement (#1396)
* Add active licenses in a tenant example * Add more examples for Audit SignIn Logs * Add license information * Add group examples * Modified unified group example * Removing backtick
1 parent bbf0c4e commit ab376f3

File tree

10 files changed

+567
-46
lines changed

10 files changed

+567
-46
lines changed

‎module/docs/entra-powershell-beta/DirectoryManagement/Get-EntraBetaTenantDetail.md‎

Lines changed: 25 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,30 @@ Contoso1 bbbbbbbb-1111-2222-3333-cccccccccccc NL {@{Capabiliti
7070

7171
This example shows how to retrieve all tenant details.
7272

73-
### Example 2: Get top one tenant details
73+
### Example 2: Get all licenses in the tenant
74+
75+
```powershell
76+
Connect-Entra -Scopes 'Organization.Read.All'
77+
Get-EntraBetaTenantDetail | Select-Object -ExpandProperty ProvisionedPlans
78+
```
79+
80+
```Output
81+
CapabilityStatus ProvisioningStatus Service AdditionalProperties
82+
---------------- ------------------ ------- --------------------
83+
Enabled Success SharePoint
84+
Enabled Success exchange
85+
Enabled Success exchange
86+
Enabled Success exchange
87+
Enabled Success SCO
88+
Enabled Success exchange
89+
Enabled Success SharePoint
90+
Enabled Success CloudPC-MX
91+
Enabled Success YammerEnterprise
92+
```
93+
94+
This example shows how to retrieve all licenses in the tenant.
95+
96+
### Example 3: Get top one tenant details
7497

7598
```powershell
7699
Connect-Entra -Scopes 'Organization.Read.All'
@@ -85,7 +108,7 @@ Contoso aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb NL {@{Capabiliti
85108

86109
This example shows how to retrieve details of a top one tenant in Microsoft Entra ID. You can use `-Limit` as an alias for `-Top`.
87110

88-
### Example 3: Get directory tenant size quota
111+
### Example 4: Get directory tenant size quota
89112

90113
```powershell
91114
Connect-Entra -Scopes 'Organization.Read.All'

‎module/docs/entra-powershell-beta/Groups/Get-EntraBetaGroup.md‎

Lines changed: 9 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -94,24 +94,23 @@ SimpleTestGrp eeeeeeee-4444-5555-6666-ffffffffffff NickName
9494

9595
This example demonstrates how to retrieve specific group by providing ID.
9696

97-
### Example 3: Get top five groups
97+
### Example 3: Retrieve Microsoft 365 (Unified) groups
9898

9999
```powershell
100100
Connect-Entra -Scopes 'GroupMember.Read.All'
101-
Get-EntraBetaGroup -Top 5
101+
Get-EntraBetaGroup -Filter "groupTypes/any(g:g eq 'Unified')" -Top 4
102102
```
103103

104104
```Output
105-
DisplayName Id MailNickname Description GroupTypes
106-
----------- -- ------------ ----------- ----------
107-
SimpleTestGrp aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb NickName {}
108-
SimpleGroup bbbbbbbb-1111-2222-3333-cccccccccccc NickName {}
109-
testGroupInAU10 cccccccc-2222-3333-4444-dddddddddddd testGroupInAU10 testGroupInAU10 {DynamicMembership, Unified}
110-
My new group dddddddd-3333-4444-5555-eeeeeeeeeeee NotSet New created group {}
111-
SimpleGroup eeeeeeee-4444-5555-6666-ffffffffffff NickName {}
105+
DisplayName Id MailNickname GroupTypes
106+
----------- -- ------------ ----------
107+
Contoso Group hhhhhhhh-3333-5555-3333-qqqqqqqqqqqq contosogroup {Unified}
108+
Crimson Eagle pppppppp-4444-0000-8888-yyyyyyyyyyyy crimsoneagle {Unified}
109+
Bold Falcon tttttttt-0000-3333-9999-mmmmmmmmmmmm boldfalcon {Unified}
110+
Misty Fox qqqqqqqq-5555-0000-1111-hhhhhhhhhhhh mistyfox {Unified}
112111
```
113112

114-
This example demonstrates how to get top five groups. You can use `-Limit` as an alias for `-Top`.
113+
This example retrieves Microsoft 365 (Unified) groups. You can use `-Limit` as an alias for `-Top`.
115114

116115
### Example 4: Get a group by DisplayName
117116

‎module/docs/entra-powershell-beta/Reports/Get-EntraBetaAuditDirectoryLog.md‎

Lines changed: 105 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,90 @@ SSGM_cccccccc-2222-3333-4444-dddddddddddd 17/07/2024 07:13:08 GroupsODataV4
6464

6565
This command gets all audit logs.
6666

67-
### Example 2: Get first n logs
67+
### Example 2: List audit logs of group creation
68+
69+
```powershell
70+
Connect-Entra -Scopes 'AuditLog.Read.All, Directory.Read.All'
71+
$groupId = (Get-EntraBetaGroup -SearchString 'Woodgrove DevOps').Id
72+
Get-EntraBetaAuditDirectoryLog -Filter "
73+
activityDisplayName eq 'Add group'
74+
and targetResources/any(r:r/id eq '$groupId')"
75+
```
76+
77+
```Output
78+
Id ActivityDateTime ActivityDisplayName Category CorrelationId LoggedByService OperationType Result ResultReason
79+
-- ---------------- ------------------- -------- ------------- --------------- ------------- ------ ------------
80+
Directory_aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb 03/06/2025 22:22:17 Add group GroupManagement aaaa0000-bb11-2222-33cc-444444dddddd Core Directory Add success
81+
```
82+
83+
This command gets all audit logs of group creation.
84+
85+
### Example 3: Retrieve recent group creation audit logs
86+
87+
```powershell
88+
Connect-Entra -Scopes 'AuditLog.Read.All, Directory.Read.All'
89+
Get-EntraBetaAuditDirectoryLog -Filter "activityDisplayName eq 'Add group'" -Limit 5 |
90+
Select-Object id, activityDateTime,
91+
@{Name="InitiatedByUPN"; Expression={ $_.initiatedBy.user.userPrincipalName }},
92+
result,
93+
@{Name="GroupDisplayName"; Expression={ $_.targetResources[0].displayName }} |
94+
Format-Table -AutoSize
95+
```
96+
97+
```Output
98+
Id ActivityDateTime InitiatedByUPN Result GroupDisplayName
99+
-- ---------------- -------------- ------ ----------------
100+
Directory_11111111-2222-3333-4444-555555555555 03/07/2025 18:30:45 [email protected] success Woodgrove Developers
101+
Directory_aaaa0000-bb11-2222-33cc-444444dddddd 03/06/2025 22:22:17 [email protected] success Woodgrove DevOps
102+
Directory_99999999-8888-7777-6666-555555555555 03/05/2025 15:10:12 [email protected] success Security Team
103+
```
104+
105+
This command retrieves recent group creation audit logs.
106+
107+
### Example 4: Show user's updated authentication method details
108+
109+
```powershell
110+
Connect-Entra -Scopes 'AuditLog.Read.All, Directory.Read.All'
111+
$userId = (Get-EntraBetaUser -UserId '[email protected]').Id
112+
Get-EntraBetaAuditDirectoryLog -Filter "category eq 'UserManagement' and LoggedByService eq 'Authentication Methods' and targetResources/any(r:r/id eq '$userId')"
113+
```
114+
115+
```Output
116+
Id ActivityDateTime ActivityDisplayName Category CorrelationId LoggedByService OperationType Result ResultReason
117+
-- ---------------- ------------------- -------- ------------- --------------- ------------- ------ ------------
118+
Authentication Methods_{GUID} 02/17/2025 13:20:08 User registered security info UserManagement aaaa0000-bb11-2222-33cc-444444dddddd Authentication Methods ServiceApi success User registered Fido2 Authentication Method
119+
Authentication Methods_{GUID} 02/17/2025 13:19:57 Get passkey creation options UserManagement bbbb1111-cc22-3333-44dd-555555eeeeee Authentication Methods ServiceApi success Successfully retrieved passkey creation options.
120+
Authentication Methods_{GUID} 02/15/2025 17:38:02 User registered security info UserManagement cccc2222-dd33-4444-55ee-666666ffffff Authentication Methods ServiceApi success User registered temporary access pass method
121+
```
122+
123+
This command retrieves user's updated authentication method details.
124+
125+
### Example 5: List quarantined provisioning jobs
126+
127+
```powershell
128+
Connect-Entra -Scopes 'AuditLog.Read.All, Directory.Read.All'
129+
Get-EntraBetaAuditDirectoryLog -Filter "activityDisplayName eq 'Quarantine'" -Limit 1 |
130+
Select-Object Id, ActivityDateTime, ActivityDisplayName, Category, LoggedByService, Result,
131+
ResultReason,
132+
@{Name="InitiatedByDisplayName"; Expression={ $_.targetResources[0].displayName }}
133+
```
134+
135+
```Output
136+
id : Sync_{GUID}
137+
activityDateTime : 02/14/2025 04:23:38
138+
activityDisplayName : Quarantine
139+
category : ProvisioningManagement
140+
loggedByService : Account Provisioning
141+
result : failure
142+
resultReason : This run profile is being quarantined because of: EncounteredQuarantineException; Error: Your ServiceNow credentials are invalid. Please obtain valid ServiceNow credentials, navigate to your ServiceNow enterprise application in the Azure Portal, and ente
143+
r those details in the admin credentials section of the provisioning configuration page. For directions on how to input credentials into your application, review the tutorial specific to ServiceNow found here: https://docs.microsoft.com/en-us/azure/activ
144+
e-directory/saas-apps/servicenow-provisioning-tutorial
145+
InitiatedByDisplayName : ServiceNow
146+
```
147+
148+
This command retrieves quarantined provisioning jobs.
149+
150+
### Example 6: Get first n logs
68151

69152
```powershell
70153
Connect-Entra -Scopes 'AuditLog.Read.All, Directory.Read.All'
@@ -82,7 +165,7 @@ Directory_aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb_8IAPT_617717139 17/07/2024 08:55:
82165

83166
This example returns the first N logs. You can use `-Limit` as an alias for `-Top`.
84167

85-
### Example 3: Get audit logs containing a given ActivityDisplayName
168+
### Example 7: Get audit logs containing a given ActivityDisplayName
86169

87170
```powershell
88171
Connect-Entra -Scopes 'AuditLog.Read.All, Directory.Read.All'
@@ -97,7 +180,7 @@ Application Proxy_aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb 16/07/2024 05:13:49 Updat
97180

98181
This command shows how to get audit logs by ActivityDisplayName. You can use `-Limit` as an alias for `-Top`.
99182

100-
### Example 4: Get all audit logs with a given result
183+
### Example 8: Get all audit logs with a given result
101184

102185
```powershell
103186
Connect-Entra -Scopes 'AuditLog.Read.All, Directory.Read.All'
@@ -106,6 +189,25 @@ Get-EntraBetaAuditDirectoryLog -Filter "result eq 'failure'" -All
106189

107190
This command shows how to get audit logs by the result.
108191

192+
### Example 9: Show when users were added to a group
193+
194+
```powershell
195+
Connect-Entra -Scopes 'AuditLog.Read.All, Directory.Read.All'
196+
$groupId = (Get-EntraBetaGroup -SearchString 'Contoso Group').Id
197+
Get-EntraBetaAuditDirectoryLog -Filter "
198+
activityDisplayName eq 'Add member to group'
199+
and targetResources/any(r:r/type eq 'User')
200+
and targetResources/any(r:r/id eq '$groupId' and r/type eq 'Group')"
201+
```
202+
203+
```Output
204+
Id ActivityDateTime ActivityDisplayName Category CorrelationId LoggedByService OperationType Result ResultReason
205+
-- ---------------- ------------------- -------- ------------- --------------- ------------- ------ ------------
206+
Directory_{GUID} 03/07/2025 23:16:31 Add member to group GroupManagement aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb Core Directory Assign success
207+
```
208+
209+
This command shows when users were added to a group.
210+
109211
## Parameters
110212

111213
### -All

‎module/docs/entra-powershell-beta/Reports/Get-EntraBetaAuditSignInLog.md‎

Lines changed: 113 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,116 @@ dddddddd-3333-4444-5555-eeeeeeeeeeee Azure Active Directory PowerShell 33334444
6565

6666
This example returns all audit logs of sign-ins.
6767

68-
### Example 2: Get the first two logs
68+
### Example 2: List sign-ins failing Conditional Access policies
69+
70+
```powershell
71+
Connect-Entra -Scopes 'AuditLog.Read.All','Directory.Read.All'
72+
Get-EntraBetaAuditSignInLog -Filter "conditionalAccessStatus eq 'failure'" -Limit 10 | Select-Object id, userDisplayName, createdDateTime, appDisplayName, status
73+
```
74+
75+
```Output
76+
id : aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb
77+
userDisplayName : Saywer Miller
78+
createdDateTime : 03/08/2025 04:03:14
79+
appDisplayName : Microsoft Edge
80+
status : @{errorCode=50158; failureReason=External security challenge not satisfied. User will be redirected to another page or authentication provider to satisfy additional authentication challenges.; additionalDetails=The user is required to satisfy additional require
81+
ments before finishing authentication, and was redirected to another page (such as terms of use or a third party MFA provider). This code alone does not indicate a failure on your users part to sign in. The sign in logs may indicate that this challenge was succ
82+
esfully passed or failed.}
83+
```
84+
85+
This example returns all audit logs of sign-ins failing Conditional Access policies.
86+
87+
### Example 3: List sign-ins from non-compliant devices
88+
89+
```powershell
90+
Connect-Entra -Scopes 'AuditLog.Read.All','Directory.Read.All'
91+
Get-EntraBetaAuditSignInLog -Filter "deviceDetail/isCompliant eq false" -Top 1 | Select-Object id, userDisplayName, appDisplayName, clientAppUsed, conditionalAccessStatus, deviceDetail, status
92+
```
93+
94+
```Output
95+
id : aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb
96+
userDisplayName : Sawyer Miller
97+
appDisplayName : Security Copilot
98+
clientAppUsed : Browser
99+
conditionalAccessStatus : success
100+
deviceDetail : @{operatingSystem=Windows10; trustType=Azure AD registered; 22223333-cccc-4444-dddd-5555eeee6666; isCompliant=False; isManaged=False; browser=Edge 133.0.0; displayName=devbox}
101+
status : @{errorCode=50011; failureReason=The {redirectTerm} '{replyAddress}' specified in the request does not match the {redirectTerm}s configured for the application '{identifier}'. Make sure the {redirectTerm} sent in the request matches one added to your ap
102+
plication in the Azure portal. Navigate to {akamsLink} to learn more about how to fix this. {detail}; additionalDetails=Developer error - the app is attempting to sign in without the necessary or correct authentication parameters.}
103+
```
104+
105+
This example returns all audit logs of sign-ins from non-compliant devices.
106+
107+
### Example 4: List sign-in failures due to a specific Conditional Access policy
108+
109+
```powershell
110+
Connect-Entra -Scopes 'AuditLog.Read.All','Directory.Read.All'
111+
$policyId = "dcf66a39-965f-4958-871f-f62613b6cabd"
112+
Get-EntraBetaAuditSignInLog -Filter "
113+
conditionalAccessStatus eq 'failure'
114+
and appliedConditionalAccessPolicies/any(c:c/id eq '$policyId' and c/result eq 'failure')" -Limit 1 |
115+
Select-Object id, userDisplayName, appDisplayName, clientAppUsed,
116+
conditionalAccessStatus, status, appliedConditionalAccessPolicies
117+
```
118+
119+
```Output
120+
id : aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb
121+
userDisplayName : ASawyer Miller
122+
appDisplayName : Azure Portal
123+
clientAppUsed : Browser
124+
conditionalAccessStatus : failure
125+
status : @{errorCode=50158; failureReason=External security challenge not satisfied. User will be redirected to another page or authentication provider to satisfy additional authentication challenges.; additionalDetails=The user is required to satisfy a
126+
dditional requirements before finishing authentication, and was redirected to another page (such as terms of use or a third party MFA provider). This code alone does not indicate a failure on your users part to sign in. The sign in logs may ind
127+
icate that this challenge was succesfully passed or failed.}
128+
appliedConditionalAccessPolicies : {@{id=22223333-cccc-4444-dddd-5555eeee6666; enforcedSessionControls=System.Object[]; displayName=CAX - All Contoso (and Guest) Users; result=failure; enforcedGrantControls=System.Object[]}, @{id=00001111-aaaa-2222-bbbb-3333cccc4444; enf
129+
orcedSessionControls=System.Object[]; displayName=CA01 - MFA - All Apps - All Users; result=success; enforcedGrantControls=System.Object[]}, @{id=22223333-cccc-4444-dddd-5555eeee6666; enforcedSessionControl
130+
s=System.Object[]; displayName=CA001 - Require Passwordless Auth and TAP - All Users; result=success; enforcedGrantControls=System.Object[]}, @{id=33334444-dddd-5555-eeee-6666ffff7777; enforcedSessionControls=System.Object[]; displayName=CA14 -
131+
Require MFA for VPN Access; result=notApplied; enforcedGrantControls=System.Object[]}…}
132+
```
133+
134+
This example returns all audit logs of sign-ins failures due to a specific Conditional Access policy.
135+
136+
### Example 5: List risky sign-ins
137+
138+
```powershell
139+
Connect-Entra -Scopes 'AuditLog.Read.All','Directory.Read.All'
140+
Get-EntraBetaAuditSignInLog -Filter "
141+
(riskLevelDuringSignIn ne 'none' or
142+
riskEventTypes_v2/any(r:r ne 'none'))
143+
" -Limit 1 |
144+
Select-Object id, userDisplayName, appDisplayName, clientAppUsed,
145+
riskLevelDuringSignIn, riskEventTypes_v2
146+
```
147+
148+
```Output
149+
id : aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb
150+
userDisplayName : Sawyer Miller
151+
appDisplayName : Security Copilot
152+
clientAppUsed : Browser
153+
riskLevelDuringSignIn : low
154+
riskEventTypes_v2 : {unfamiliarFeatures}
155+
```
156+
157+
This example returns all audit logs of risky sign-ins.
158+
159+
### Example 6: Get sign-ins without MFA
160+
161+
```powershell
162+
Connect-Entra -Scopes 'AuditLog.Read.All','Directory.Read.All'
163+
Get-EntraBetaAuditSignInLog -Filter "authenticationRequirement ne 'multiFactorAuthentication' and isInteractive eq true"
164+
```
165+
166+
```Output
167+
Id AppDisplayName AppId AppTokenProtectionStatus AuthenticationMethodsUsed AuthenticationProtocol
168+
-- -------------- ----- ------------------------ ------------------------- ----------------------
169+
aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb Azure Active Directory PowerShell 00001111-aaaa-2222-bbbb-3333cccc4444 {} none
170+
bbbbbbbb-1111-2222-3333-cccccccccccc Azure Portal 11112222-bbbb-3333-cccc-4444dddd5555 {} none
171+
cccccccc-2222-3333-4444-dddddddddddd Azure Active Directory PowerShell 22223333-cccc-4444-dddd-5555eeee6666 {} none
172+
dddddddd-3333-4444-5555-eeeeeeeeeeee Azure Active Directory PowerShell 33334444-dddd-5555-eeee-6666ffff7777 {} none
173+
```
174+
175+
This example returns all audit logs of sign-ins without MFA.
176+
177+
### Example 7: Get the first two logs
69178

70179
```powershell
71180
Connect-Entra -Scopes 'AuditLog.Read.All','Directory.Read.All'
@@ -81,7 +190,7 @@ bbbbbbbb-1111-2222-3333-cccccccccccc Azure Portal 11112222
81190

82191
This example returns the first two audit logs of sign-ins. You can use `-Limit` as an alias for `-Top`.
83192

84-
### Example 3: Get audit logs containing a given AppDisplayName
193+
### Example 8: Get audit logs containing a given AppDisplayName
85194

86195
```powershell
87196
Connect-Entra -Scopes 'AuditLog.Read.All','Directory.Read.All'
@@ -96,7 +205,7 @@ aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb Graph Explorer PowerShell 00001111-aaaa-22
96205

97206
This example demonstrates how to retrieve sign-in logs by AppDisplayName. You can use `-Limit` as an alias for `-Top`.
98207

99-
### Example 4: Get all sign-in logs between dates
208+
### Example 9: Get all sign-in logs between dates
100209

101210
```powershell
102211
Connect-Entra -Scopes 'AuditLog.Read.All','Directory.Read.All'
@@ -105,7 +214,7 @@ Get-EntraBetaAuditSignInLog -Filter "createdDateTime ge 2024-07-01T00:00:00Z and
105214

106215
This example shows how to retrieve sign-in logs between dates.
107216

108-
### Example 5: List failed sign-ins for a user
217+
### Example 10: List failed sign-ins for a user
109218

110219
```powershell
111220
Connect-Entra -Scopes 'AuditLog.Read.All','Directory.Read.All'

0 commit comments

Comments
 (0)