azure - 提取过去 7 天内的所有 Azure Active Directory (AAD) 登录

Question

我正在尝试在 azure runbook 中获取过去 7 天内的最后一次登录日志，我尝试过以下代码:

$SetDate = (Get-Date).AddDays(-7);
$SetDate = Get-Date($SetDate) -format yyyy-MM-dd
$array = Get-AzureADAuditSignInLogs -Filter "createdDateTime gt $SetDate" | select userDisplayName, userPrincipalName, appDisplayName, ipAddress, clientAppUsed, @{Name = 'DeviceOS'; Expression = {$_.DeviceDetail.OperatingSystem}},@{Name = 'Location'; Expression = {$_.Location.City}}

$array

但它不起作用，它向我显示一条错误消息，其中显示:

System.Management.Automation.CommandNotFoundException: The term 'Get-AzureADAuditSignInLogs' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.

有人可以帮忙吗？

Answer 1

请通过运行以下命令检查 AzureAD 模块是否存在:

Get-Module -Name AzureAD

如果它仍然存在，请尝试使用以下命令卸载它:

Uninstall-Module AzureAD  

卸载AzureAD模块后，现在安装AzureADPreview模块并导入它，如下所示:

Install-Module AzureADPreview 

Import-Module AzureADPreview 

请注意，如果 AzureAD 模块存在，AzureADPreview 模块将无法工作。

我尝试在我的环境中重现相同的内容并成功获得响应，如下所示:

$SetDate = (Get-Date).AddDays(-7);  
$SetDate = Get-Date($SetDate) -format yyyy-MM-dd  
$array = Get-AzureADAuditSignInLogs -Filter "createdDateTime gt $SetDate" | select userDisplayName, userPrincipalName, appDisplayName, ipAddress, clientAppUsed, @{Name = 'DeviceOS';  
Expression = {$.DeviceDetail.OperatingSystem}},@{Name = 'Location'; Expression = {$.Location.City}}  
$array  

回应:

如果您在 Mac 上工作，我确实同意 GauravMantri 的观点。