Search code examples
powershellazure-active-directory

AzureADLogs Powershell - audit when a user has been disable or enabled

So I am trying to find out the Azure AD logs via PowerShell, when a user has been enable or disabled, specially the date & time and preferably who did it as well.

I've tried using the follow, but I am not sure what I am supposed to be looking for.

Get-AzureADAuditSignInLogs -Filter "createdDateTime gt 2023-05-30" | SELECT *

or

Get-MgAuditLogSignIn -Filter "createdDateTime ge 2023-05-29T00:00:00Z  and createdDateTime le 2023-06-03T00:00:00Z"

How can I filter to just when someone has been enabled or disabled?
I know how to find the disabled users with

Get-ADUser -Filter {Enabled -eq $False}

but I just need to know who and when they were disabled.

Solution

  • Whenever user account is enabled or disabled, it will be saved with Activity name as Enable account and Disable account respectively in Audit logs.

    You can run below command to check who and when users are disabled:

    Get-AzureADAuditDirectoryLogs -Filter "activityDisplayName eq 'Disable account' " | where-object Result -eq "Success" | fl

    Response:

    enter image description here

    Similarly, you can run below command to check who and when users are enabled:

    Get-AzureADAuditDirectoryLogs -Filter "activityDisplayName eq 'Enable account' " | where-object Result -eq "Success" | fl

    Response:

    enter image description here

    To get the same results using Microsoft Graph PowerShell, you can check below commands:

    Disabled users:

    Import-Module Microsoft.Graph.Reports
Get-MgAuditLogDirectoryAudit -Filter  "activityDisplayName eq 'Disable account' and result eq 'Success'" | fl

    Enabled users:

    Import-Module Microsoft.Graph.Reports
Get-MgAuditLogDirectoryAudit -Filter  "activityDisplayName eq 'Enable account' and result eq 'Success'" | fl