查看访问sharepoint网站搜索的用户UnifiedAuditLog

我正在尝试导出访问过我的收藏中不同sharepoint网站的用户列表。我已经尝试过了，我可以让它与内部用户一起工作，但不能用于外部用户

$startdate = "11/10/2017 8:00 AM"
$enddate = "11/10/2017 9:00 AM"
$userIDs = (import-csv C:\Junk\User.csv).Email
foreach ($userid in $userids) {
    $AuditlogMain = Search-UnifiedAuditLog -StartDate $startdate -EndDate $enddate -RecordType SharePoint -Operations PageViewed -UserIds $userID -ObjectIds "https://sitename.sharepoint.com/" -Formatted
    $AuditlogMain.UserIDs | Select-object -Unique | Out-File C:\junk\Main.csv -Append
}

然后我会得到一个唯一用户列表，但我也想列出所有外部用户，我不知道如何简单地将邮件从“@.com”更改为“EXT”onmicrosoft.com

或者有没有更简单的方法来导出访问过站点的用户？ 如果您查看

$AuditlogMain.AuditData

中的内容，我想了解更多信息，但不知道如何提取。所以，如果有人可以帮助我处理外部用户，或者更优选地帮助我从

$AuditlogMain.AuditData

中提取

ClientIP、ObjectId、UserId

，这将非常有用

---

提前感谢

提供的文章摘录：

$cred = Get-Credential

$session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $cred -Authentication Basic -AllowRedirection
Import-PSSession $session
Connect-MsolService -Credential $cred

$extUsers = Get-MsolUser | Where-Object {$_.UserPrincipalName -like "*#EXT#*" }

$extUsers | ForEach {
    $auditEventsForUser = Search-UnifiedAuditLog -EndDate $((Get-Date)) -StartDate $((Get-Date).AddDays(-7)) -UserIds $_.UserPrincipalName

    Write-Host "Events for" $_.DisplayName "created at" $_.WhenCreated

    $auditEventsForUser | FT
}

Remove-PSSession $session

这里有一篇文章解释了如何为外部用户获取审计信息：

---

提供的文章摘录：

$cred = Get-Credential

$session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $cred -Authentication Basic -AllowRedirection
Import-PSSession $session
Connect-MsolService -Credential $cred

$extUsers = Get-MsolUser | Where-Object {$_.UserPrincipalName -like "*#EXT#*" }

$extUsers | ForEach {
    $auditEventsForUser = Search-UnifiedAuditLog -EndDate $((Get-Date)) -StartDate $((Get-Date).AddDays(-7)) -UserIds $_.UserPrincipalName

    Write-Host "Events for" $_.DisplayName "created at" $_.WhenCreated

    $auditEventsForUser | FT
}

Remove-PSSession $session

这里有一篇文章解释了如何为外部用户获取审计信息：