powershell-scripts/Audit Compromised User Activities from a Specific Session

Trace Session ID-Based Activities Across Microsoft 365 Using PowerShell

The script helps security teams rebuild the user’s activity timeline by collecting session ID-based audit logs in a consistent and easy-to-analyze format.

Sample Output:

Find the script output log file in CSV format that shows the result of the operation.

Microsoft 365 Reporting Tool by AdminDroid

Looking for more in-depth reporting? AdminDroid Microsoft 365 reporting tool offers an extensive collection of 3,500+ out-of-the-box reports and dashboards. It’s the perfect complement to your PowerShell scripts.

View more comprehensive audit reports through AdminDroid: http://localhost:8080/#/M365/1/1/reports/29801/1/20?nodeId=3439