diff --git a/Audit Compromised User Activities from a Specific Session/README.md b/Audit Compromised User Activities from a Specific Session/README.md
new file mode 100644
index 0000000..53ff044
--- /dev/null
+++ b/Audit Compromised User Activities from a Specific Session/README.md	
@@ -0,0 +1,16 @@
+## Trace Session ID-Based Activities Across Microsoft 365 Using PowerShell    
+The script helps security teams rebuild the user’s activity timeline by collecting session ID-based audit logs in a consistent and easy-to-analyze format.
+
+***Sample Output:***
+
+Find the script output log file in CSV format that shows the result of the operation.
+
+![Session ID-based Audit Logs](https://blog.admindroid.com/wp-content/uploads/2025/08/Session-ID-based-Audit-Logs.png)
+## Microsoft 365 Reporting Tool by AdminDroid
+Looking for more in-depth reporting? [AdminDroid Microsoft 365 reporting tool](https://admindroid.com/?src=GitHub) offers an extensive collection of 3,500+ out-of-the-box reports and dashboards. It’s the perfect complement to your PowerShell scripts. 
+
+*View more comprehensive audit reports through AdminDroid: [*http://localhost:8080/#/M365/1/1/reports/29801/1/20?nodeId=3439*](http://localhost:8080/#/M365/1/1/reports/29801/1/20?nodeId=3439)*
+
+
+
+