Get-NonInteractiveLog

SYNOPSIS

Downloads non-interactive Entra ID sign-in logs for one or more users.

SYNTAX

Get-NonInteractiveLog [[-UserObject] <PSObject[]>] [-Days <Int32>] [-Beta <Boolean>] [-Xml <Boolean>]
 [-Script <Boolean>] [-Open <Boolean>] [-ProgressAction <ActionPreference>] [<CommonParameters>]

DESCRIPTION

A convenience wrapper around Get-SignInLog that sets -NonInteractive automatically. Non-interactive sign-ins include token refresh events, legacy protocol logins, and service-to-service calls - often missed during investigations that focus only on interactive sign-ins.

Date range and output behavior are identical to Get-SignInLog. Falls back to $Global:IRT_UserObjects if no -UserObject is passed.

EXAMPLES

EXAMPLE 1

Get-NonInteractiveLog
Downloads non-interactive sign-in logs for the user in the global session.

EXAMPLE 2

Get-NonInteractiveLog -UserObject $User -Days 30
Downloads 30 days of non-interactive sign-ins for a specific user.

PARAMETERS

-UserObject

One or more user objects to query. Falls back to global session objects if omitted.

Type: PSObject[]
Parameter Sets: (All)
Aliases: UserObjects

Required: False
Position: 1
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Days

Number of days back to search.

Type: Int32
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: 0
Accept pipeline input: False
Accept wildcard characters: False

-Beta

Use the Microsoft Graph beta endpoint. Default: $true.

Type: Boolean
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: True
Accept pipeline input: False
Accept wildcard characters: False

-Xml

Export raw XML alongside the Excel file. Defaults to IRT_Config.ExportXml.

Type: Boolean
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: $Global:IRT_Config.ExportXml
Accept pipeline input: False
Accept wildcard characters: False

-Script

Return raw objects instead of exporting to Excel. Default: $false.

Type: Boolean
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-Open

Open the Excel file immediately after export. Default: $true.

Type: Boolean
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: True
Accept pipeline input: False
Accept wildcard characters: False

-ProgressAction

{{ Fill ProgressAction Description }}

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS

OUTPUTS

None by default. PSCustomObject[] when -Script is $true.

NOTES

Version: 1.0.0

RELATED LINKS