View Audit Logs - Document Details

About This Page

This page is part of the Azure documentation. It contains code examples and configuration instructions for working with Azure services.

View on GitHub 📚 View on Microsoft Learn

Bias Analysis

Detected Bias Types

powershell_heavy

missing_linux_example

windows_tools

Summary

The documentation provides only a PowerShell script for programmatically accessing audit logs, with no equivalent examples for Linux users (e.g., Bash/cURL or Python). The script assumes use of PowerShell, which is primarily a Windows tool, and there is no mention of cross-platform alternatives or guidance for Linux/macOS users. This creates a Windows-centric bias in the programmatic access section.

Recommendations

Add a Bash/cURL example for calling the Microsoft Graph API to retrieve audit logs, suitable for Linux/macOS users.
Provide a Python script example, as Python is widely available cross-platform and commonly used for automation.
Explicitly mention that PowerShell Core is available on Linux/macOS, or provide instructions for installing it if retaining PowerShell examples.
Ensure that all code examples are presented in both Windows (PowerShell) and Linux (Bash/cURL or Python) variants where possible.
Review the documentation for other implicit Windows tool assumptions and clarify cross-platform compatibility.

Create Pull Request

Scan History

Date	Scan	Status	Result
2026-01-12 00:00	#99	completed	Biased
2026-01-11 06:20	#98	completed	Biased
2026-01-11 00:00	#95	cancelled	Clean
2026-01-10 00:00	#92	completed	Clean
2026-01-09 00:00	#87	cancelled	Clean
2026-01-08 00:00	#84	in_progress	Clean
2026-01-06 22:28	#78	completed	Clean
2026-01-06 18:40	#75	cancelled	Clean
2025-12-29 18:00	#48	cancelled	Biased
2025-12-22 00:00	#24	cancelled	Clean
2025-12-15 00:00	#7	completed	Clean
2025-12-14 05:05	#6	completed	Clean

Flagged Code Snippets

# This script requires an application registration that's granted Microsoft Graph API permission
# https://learn.microsoft.com/azure/active-directory-b2c/microsoft-graph-get-started

# Constants
$ClientID       = "your-client-application-id-here"       # Insert your application's client ID, a GUID
$ClientSecret   = "your-client-application-secret-here"   # Insert your application's client secret value
$tenantdomain   = "your-b2c-tenant.onmicrosoft.com"       # Insert your Azure AD B2C tenant domain name

$loginURL       = "https://login.microsoftonline.com"
$resource       = "https://graph.microsoft.com"           # Microsoft Graph API resource URI
$7daysago       = "{0:s}" -f (get-date).AddDays(-7) + "Z" # Use 'AddMinutes(-5)' to decrement minutes, for example
Write-Output "Searching for events starting $7daysago"

# Create HTTP header, get an OAuth2 access token based on client id, secret and tenant domain
$body       = @{grant_type="client_credentials";resource=$resource;client_id=$ClientID;client_secret=$ClientSecret}
$oauth      = Invoke-RestMethod -Method Post -Uri $loginURL/$tenantdomain/oauth2/token?api-version=1.0 -Body $body

# Parse audit report items, save output to file(s): auditX.json, where X = 0 through n for number of nextLink pages
if ($oauth.access_token -ne $null) {
    $i=0
    $headerParams = @{'Authorization'="$($oauth.token_type) $($oauth.access_token)"}
    $url = "https://graph.microsoft.com/v1.0/auditLogs/directoryAudits?`$filter=loggedByService eq 'B2C' and activityDateTime gt  " + $7daysago

    # loop through each query page (1 through n)
    Do {
        # display each event on the console window
        Write-Output "Fetching data using Uri: $url"
        $myReport = (Invoke-WebRequest -UseBasicParsing -Headers $headerParams -Uri $url)
        foreach ($event in ($myReport.Content | ConvertFrom-Json).value) {
            Write-Output ($event | ConvertTo-Json)
        }

        # save the query page to an output file
        Write-Output "Save the output to a file audit$i.json"
        $myReport.Content | Out-File -FilePath audit$i.json -Force
        $url = ($myReport.Content | ConvertFrom-Json).'@odata.nextLink'
        $i = $i+1
    } while($url -ne $null)
} else {
    Write-Host "ERROR: No Access Token"
}