How to query Azure user operation records

This article is about how to query the records of Azure users. The editor thinks it is very practical, so share it with you as a reference and follow the editor to have a look.

Let's take a look at the contents of the code, which is actually very simple.

Param ([parameter (Mandatory = $false)] [Int] $MaxRecords = 100000, [parameter (Mandatory = $true)] [string] $User) function Write-DateTimeMessage {param ([parameter (Mandatory = $false)] [switch] $Warning, [parameter (Mandatory = $true)] [string] $Message [parameter (Mandatory = $false)] [string] $ForegroundColor) if ($Warning) {Write-Warning ($(Get-Date-UFormat'% Y/%m/%d% HV% MV% S') + "*" + $Message)} else {if ($ForegroundColor) {Write-Host ($(Get-Date-UFormat'% Y /) % m Write-Host% d% UFormat% MRV% S') + "*" + $Message)-ForegroundColor $ForegroundColor} else {Write-Host ($(Get-Date-UFormat'% Y/%m/%d% HV% MV% S') + "*" + $Message)}} [pscustomobject []] $UserObjects = $null$Subscriptions = Get-AzureRmSubscriptionforeach ($subscription in $Subscriptions) ) {"" Querying Subscription: "$SubscriptionID = $Subscription.Id $SubscriptionName = $Subscription.Name Select-AzureRmSubscription-SubscriptionId $SubscriptionID-InformationAction SilentlyContinue Write-DateTimeMessage-Message" Retrieving logs Please wait... "$logs = Get-AzureRmLog-ResourceProvider Microsoft.Compute-StartTime (Get-Date). AddDays (- 90)-Maxrecord $MaxRecords foreach ($log in $logs) {if ($log.caller-eq $User) {$UserObject = New-Object-TypeName psobject $UserObject | Add-Member-MemberType NoteProperty-Name SubscriptionName-Value $SubscriptionName $UserObject | Add-Member-MemberType NoteProperty-Name SubscriptionID-Value $SubscriptionID $UserObject | Add- Member-MemberType NoteProperty-Name ResourceGroup-Value $log.ResourceGroupName $UserObject | Add-Member-MemberType NoteProperty-Name Caller-Value $log.caller $UserObject | Add-Member-MemberType NoteProperty-Name Operation-Value $log.OperationName.Value $UserObject | Add-Member-MemberType NoteProperty-Name ResourceId-Value $log.ResourceId $UserObject | Add-Member-MemberType NoteProperty-Name Time-Value $log.EventTimestamp $UserObjects + = $UserObject}} $OutputPath = Join-Path -Path ([Environment]:: GetFolderPath ("Desktop")-ChildPath ("AzureUserAction-" + $(Get-Date-Format "yyyyMMdd-HHmmss") + ".csv") if ($null-ne $UserObjects) {$UserObjects | Export-Csv-NoTypeInformation-LiteralPath $OutputPath Write-DateTimeMessage-Message "Please check $OutputPath"-Warning} else {Write-DateTimeMessage "Didn't get information Please check "- warning}

Let's try to run the script Get-AzureUserActionLog.ps1-User "xxx@xxx.partner.onmschina.cn". The purpose of-User is that we can filter out specific users based on this parameter.

After the execution of the script, you can see a csv file on the desktop, which records the query log.

Finally, I would like to remind you that because of the restrictions of the Azure background, this can only query the log within the last 90 days.

Thank you for reading! On "how to query Azure user operation records" this article is shared here, I hope the above content can be of some help to you, so that you can learn more knowledge, if you think the article is good, you can share it out for more people to see it!