PowerShell Notebook showing how to use both cmdlets available for extracting Power BI audit log events

Export_PBI_AuditLogs.ipynb

{
    "metadata": {
        "kernelspec": {
            "name": "powershell",
            "display_name": "PowerShell"
        },
        "language_info": {
            "name": "powershell",
            "codemirror_mode": "shell",
            "mimetype": "text/x-sh",
            "file_extension": ".ps1"
        }
    },
    "nbformat_minor": 2,
    "nbformat": 4,
    "cells": [
        {
            "cell_type": "markdown",
            "source": [
                "<img src=\"https://app.powerbi.com/13.0.10537.111/images/PowerBI96x96.png?raw=true\" width=\"10%\">➕\r\n",
                "<img src=\"https://github.com/Microsoft/azuredatastudio/blob/master/samples/notebookSamples/Graphics/AzureDataStudioLogo.png?raw=true\" width=\"10%\"> = ❤\r\n",
                "\r\n",
                "# Export the Power BI audit log events\r\n",
                ""
            ],
            "metadata": {
                "azdata_cell_guid": "853e398d-c547-4bfe-92c5-9a42c47028bb"
            }
        },
        {
            "cell_type": "markdown",
            "source": [
                "Export the PowerBI events from the **O365** Audit Log into separate .CSV files for each of the last 90 days.\r\n",
                "See [this Docs file](https://docs.microsoft.com/en-us/power-bi/service-admin-auditing#use-powershell-to-export-audit-logs) for more information on this feature."
            ],
            "metadata": {
                "azdata_cell_guid": "bc27f11c-62bb-4e46-bb9e-2de63b8d4c27"
            }
        },
        {
            "cell_type": "code",
            "source": [
                "$UserCredential = Get-Credential 'your.email@somewhere.com'\r\n",
                "\r\n",
                "90..1 |\r\n",
                "foreach {\r\n",
                "\r\n",
                "$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection\r\n",
                "Import-PSSession $Session\r\n",
                "\r\n",
                "$Start=((Get-Date).Date).AddDays(-$_);            \r\n",
                "Search-UnifiedAuditLog -StartDate $Start -EndDate $Start.AddDays(1) -RecordType PowerBI -ResultSize 5000 |\r\n",
                "Export-Csv -Path \"c:\\temp\\PowerBIAuditLogs\\PowerBIAudit_Log_$(Get-Date -Date $Start.AddDays(1) -Format yyyyMMdd).csv\" -NoTypeInformation\r\n",
                "\r\n",
                "Remove-PSSession $Session\r\n",
                "\r\n",
                "}"
            ],
            "metadata": {
                "azdata_cell_guid": "ff41490e-ffbf-41d5-a3c4-c1f3cffd51d0"
            },
            "outputs": [],
            "execution_count": 0
        },
        {
            "cell_type": "markdown",
            "source": [
                "## Use `Get-PowerBIActivityEvent` cmdlet\r\n",
                "\r\n",
                "Once the service supporting the `Get-PowerBIActivityEvent` cmdlet is back online, you will only need to be a Power BI Admin in order to collect Power BI audit log events."
            ],
            "metadata": {
                "azdata_cell_guid": "acc6b7f0-d936-4712-80e3-c5ae11ec7953"
            }
        },
        {
            "cell_type": "markdown",
            "source": [
                "First things first, Login to the tenant you need to work with."
            ],
            "metadata": {
                "azdata_cell_guid": "bdba884c-81b6-49af-b120-0ce529ed4d8d"
            }
        },
        {
            "cell_type": "code",
            "source": [
                "Login-PowerBI"
            ],
            "metadata": {
                "azdata_cell_guid": "4e1b619c-629d-4579-ad26-1095967e7d99"
            },
            "outputs": [],
            "execution_count": 0
        },
        {
            "cell_type": "markdown",
            "source": [
                "The example below will retrieve the current day's audit log events.  Please not the specific date-formatting required to use the cmdlet. "
            ],
            "metadata": {
                "azdata_cell_guid": "a2a19f79-7d28-4f2d-b818-d1b05bc439fe"
            }
        },
        {
            "cell_type": "code",
            "source": [
                "Get-PowerBIActivityEvent -StartDateTime (Get-Date ((Get-Date).Date) -Format yyyy-MM-ddTHH:mm:ss) -EndDateTime (Get-Date -Format yyyy-MM-ddTHH:mm:ss)"
            ],
            "metadata": {
                "azdata_cell_guid": "c7e87eec-16ca-4fb0-a5e5-4d47c263bddc"
            },
            "outputs": [],
            "execution_count": 0
        },
        {
            "cell_type": "markdown",
            "source": [
                "Retrieve the past 90 days worth of Power BI audit log events and save each day's events to it's own .json file."
            ],
            "metadata": {
                "azdata_cell_guid": "a7acadf6-5521-45da-adae-ac87e89a35fe"
            }
        },
        {
            "cell_type": "code",
            "source": [
                "90..1 |\r\n",
                "foreach {\r\n",
                "    $Date = (((Get-Date).Date).AddDays(-$_))\r\n",
                "    $StartDate = (Get-Date -Date ($Date) -Format yyyy-MM-ddTHH:mm:ss)\r\n",
                "    $EndDate = (Get-Date -Date ((($Date).AddDays(1)).AddMilliseconds(-1)) -Format yyyy-MM-ddTHH:mm:ss)\r\n",
                "    \r\n",
                "    Get-PowerBIActivityEvent -StartDateTime $StartDate -EndDateTime $EndDate -ResultType JsonString | \r\n",
                "    Out-File -FilePath \"c:\\temp\\PowerBIAuditLogs\\PowerBI_AudititLog_$(Get-Date -Date $Date -Format yyyyMMdd).json\"\r\n",
                "}"
            ],
            "metadata": {
                "azdata_cell_guid": "cc49bafc-cd3a-4a39-9b77-e5060437b807",
                "tags": []
            },
            "outputs": [],
            "execution_count": 0
        }
    ]
}