Are changes made via PowerShell logged to Azure AD Audit Log?

Posted by RipRapRob@reddit | sysadmin | View on Reddit | 4 comments

I fucked up: I tried adding a Trusted Sender to Distribution List, thinking that: Set-DistributionGroup -Identity [Identity] -AcceptMessagesOnlyFrom [TrustedSenderEmail] Would just add the new email, but (yes, i know) now the Distribution List only has that one email as a Trusted Sender :-( So I've been looking in the Azure AD Audit Log to see what changes was made, but I can only see a change a colleague made, using the GUI, an hour before. I know the Audit Log is not updated real time, but can I expect my PowerShell operation to turn up in the Audit Log at one point?

Reply to Post

4 Comments

[-]

jerminator4427@reddit

If you can’t find it in the logs maybe you can restore the group from a backup. And if that’s not possible then just do a scream test.

[-]

Kr1ezZ@reddit

1. **Azure PowerShell History**: If you are using Azure PowerShell, you can check the command history directly within PowerShell. You can use the `Get-History` cmdlet to view a history of the commands you've executed. However, this might not provide as much detail as the Azure AD Audit Log. 2. **Event Logs on Your Local Machine**: PowerShell operations may be logged in the event logs on the machine where the commands were executed. You can check the "Windows PowerShell" or "Windows PowerShell/Operational" logs in the Event Viewer on your local machine. Look for event IDs related to PowerShell operations. 3. **Other Service-Specific Logs**: Depending on the actions you were performing, you might need to check logs for the specific services or applications you were working with. For example, if you were interacting with Exchange Online, you should also look at Exchange Online audit logs.

[-]

progenyofeniac@reddit

I don't have a definite answer, but my feeling based on what I've seen is that some changes just aren't logged in AzureAD regardless of how you make them. One example was adding a user as an approved sender on a distro list. Never showed in the AAD audit logs. Maybe you can audit it elsewhere, it didn't matter enough for me to dig into it. But I don't think it's a question of Powershell vs GUI. I think it's the specific action.

[-]

RipRapRob@reddit (OP)

Thanks, my changes is still not visible in the log, so I get the feeling that I'll never see the changes in the Audit Log.