Gets usage from a particular user(s) or site(s) from the Unified Audit Log
This script will scan the ULS Logs for the last week looking for all access by a user an or to a site and create an excel file summarizing the activity
Russell GoveSummary
Say we have a user who has written a lot of flows and PowerBI reports and is complaining that she is getting throttled in SharePoint quite often.
We need to see all the calls being made by that user and/or to particular sites to attempt to narrow down the issues.
This script will scan the ULS Logs for the last week looking for all access by a user an or to a site and create an excel file summarizing the activity.
Connect-PnPOnline -Url "HTTPS://tenant-ADMIN.sharepoint.COM" -Interactive
$intervalminutes = 15
$now = Get-Date
$outputArray = @()
for ($i = 60; $i -le 11000 ; $i = $i + $intervalminutes) {
# 1 hour ago to a day ago
$starttime = $now.AddMinutes(-$i - $intervalminutes)
$endtime = $now.AddMinutes(-$i)
$results = Get-PnPUnifiedAuditLog -ContentType "SharePoint" -StartTime $starttime -EndTime $endtime
$OperationalExcellenceHub = $results | Where { $_.SiteUrl -eq "https://tenant.sharepoint.com/sites/OperationalExcellenceHub/" }
$OperationalExcellence = $results | Where { $_.SiteUrl -eq "https://tenant.sharepoint.com/sites/OperationalExcellence/" }
$user= $results | Where { $_.UserId -eq "some.user@domain.com" }
Write-Host "$i FROM $starttime TO $endtime OperationalExcellenceHub:$($OperationalExcellenceHub.Count) OperationalExcellence:$($OperationalExcellence.Count) RobS:$($Sarracini.Count) TOTAL:$($results.Count)"
$outputObject = [PSCustomObject]@{
Count = $i
StartTime = $starttime
EndTime = $endtime
OperationalExcellenceHub = $OperationalExcellenceHub.Count
OperationalExcellence = $OperationalExcellence.Count
Sarracini = $Sarracini.Count
Total = $results.Count
}
$outputArray += $outputObject
}
$outputArray | Export-Csv "c:\Temp\IOCounts.csv" -NoTypeInformation
# End
Contributors
| Author(s) |
|---|
| Russell Gove |
Disclaimer
THESE SAMPLES ARE PROVIDED AS IS WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING ANY IMPLIED WARRANTIES OF FITNESS FOR A PARTICULAR PURPOSE, MERCHANTABILITY, OR NON-INFRINGEMENT.
Tool documentation & references
- Want to learn more about the Microsoft Graph
Check out the documentation site to get started and for the reference to the endpoints.
