Gets usage from a particular user(s) or site(s) from the Unified Audit Log

Summary

Say we have a user who has written a lot of flows and PowerBI reports and is complaining that she is getting throttled in SharePoint quite often.

We need to see all the calls being made by that user and/or to particular sites to attempt to narrow down the issues.

This script will scan the ULS Logs for the last week looking for all access by a user an or to a site and create an excel file summarizing the activity.

• PnP PowerShell

Connect-PnPOnline -Url "HTTPS://tenant-ADMIN.sharepoint.COM" -Interactive
$intervalminutes = 15 
$now = Get-Date
$outputArray = @()
for ($i = 60; $i -le 11000 ; $i = $i + $intervalminutes) {
    # 1 hour ago to a day ago
    $starttime = $now.AddMinutes(-$i - $intervalminutes)
    $endtime = $now.AddMinutes(-$i)
    $results = Get-PnPUnifiedAuditLog -ContentType "SharePoint" -StartTime $starttime -EndTime $endtime
    $OperationalExcellenceHub = $results | Where { $_.SiteUrl -eq "https://tenant.sharepoint.com/sites/OperationalExcellenceHub/" }
    $OperationalExcellence = $results | Where { $_.SiteUrl -eq "https://tenant.sharepoint.com/sites/OperationalExcellence/" }
    $user= $results | Where { $_.UserId -eq "some.user@domain.com" }
    Write-Host  "$i FROM $starttime TO $endtime  OperationalExcellenceHub:$($OperationalExcellenceHub.Count) OperationalExcellence:$($OperationalExcellence.Count) RobS:$($Sarracini.Count) TOTAL:$($results.Count)"
    $outputObject = [PSCustomObject]@{
        Count                    = $i
        StartTime                = $starttime
        EndTime                  = $endtime
        OperationalExcellenceHub = $OperationalExcellenceHub.Count
        OperationalExcellence    = $OperationalExcellence.Count
        Sarracini                = $Sarracini.Count
        Total                    = $results.Count
    }
    $outputArray += $outputObject
    
}

$outputArray | Export-Csv "c:\Temp\IOCounts.csv" -NoTypeInformation

    # End

Check out the PnP PowerShell to learn more at: https://aka.ms/pnp/powershell

The way you login into PnP PowerShell has changed please read PnP Management Shell EntraID app is deleted : what should I do ?

Contributors

Author(s)
Russell Gove

Disclaimer

THESE SAMPLES ARE PROVIDED AS IS WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING ANY IMPLIED WARRANTIES OF FITNESS FOR A PARTICULAR PURPOSE, MERCHANTABILITY, OR NON-INFRINGEMENT.