How to use Get-PnPUnifiedAuditLog command

Question

I'm using Modern UI for SharePoint Online.

I'd like to export audit log using PnP PowerShell. But When I use "Get-PnPUnifiedAuditLog", the following error is occurred:

PS C:\Users\hyonta > Get-PnPUnifiedAuditLog
Get-PnPUnifiedAuditLog : Unable to retrieve a token for OfficeManagementApi. Ensure you connect using one of the Connect-PnPOnline commands which uses the -ClientId argument or use Connect-PnPOnline -Scopes to connect.
At line:1 char:1
+ Get-PnPUnifiedAuditLog
+ ~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ConnectionError: (:) [Get-PnPUnifiedAuditLog], InvalidOperationException
    + FullyQualifiedErrorId : NO_OAUTH_TOKEN,PnP.PowerShell.Commands.ManagementApi.GetUnifiedAuditLog

I'm not sure how to use ClientId or Scopes. What should I do to use the audit log output command?

Answer 1

Get-PnPUnifiedAuditLog command requires ActivityFeed.Read permissions to get unified audit logs from the Office 365 Management API.

Follow this steps:

1. Create an Azure AD app registration for the Office 365 Management API

2. Connect to SharePoint using Connect-PnPOnline command, something like below:

   Connect-PnPOnline -Url https://contoso.sharepoint.com -ClientId 344b8aab-389c-4e4a-8fa1-4c1ae2c0a60d -ClientSecret a3f3faf33f3awf3a3sfs3f3ss3f4f4a3fawfas3ffsrrffssfd
   

   Use Client Id and Client Secret of Azure AD app you created in first step.

3. Then use Get-PnPUnifiedAuditLog command.