Download Power BI Audit Logs with the New Get-PowerBIActivityEvent cmdlet

Earlier this week a new version of the MicrosoftPowerBIMgmt module was made available on the PowerShell Gallery. Two new cmdlets were included in the module Remove-PowerBIReport and Get-PowerBIActivityEvent. The Remove-PowerBIReport cmdlet was written by my coworker [and new best friend] Caroline Bell ( twitter ). Let’s take a look at both of these new cmdlets.

Remove-PowerBIReport

The Remove-PowerBIReport cmdlet can come in handy in CI/CD scenarios with Power BI. Let’s say you have copied a Report from a QA Workspace over to a Production Workspace, and chose not to overwrite the Dataset in the Production Workspace. (For clarity: In this scenario, the Dataset in the QA Workspace is connected to a QA database, while the Dataset in the Prod Workspace is connected to a Production database. And you want it to stay that way). This is a great way to test your Reports before you release them for everyone to see, but you’re left with the old version of the Report in that Production Workspace when you’re done. The Remove-PowerBIReport cmdlet can remove the old version of that(those) Report(s) in a Production Workspace after you have copied over the version from QA.

I have posted a Gist to demonstrate this scenario & technique, but I haven’t had time to blog about it just yet. Maybe in a week or two.

Get-PowerBIActivityEvent

You can now download Power BI Audit Logs using the new Get-PowerBIActivityEvent cmdet. This cmdlet saves you from having to be granted “Audit Logs or View-Only Audit Logs role in Exchange Online” permissions in Office 365. Instead, as long as you’re a Power BI Admin, you will be able to retrieve the audit logs as-is. This can be extremely useful for Power BI Governance, because being granted the View-Only Audit Logs role gives you access to all audit records across Office 365. Some organizations will not grant that capability to everyone who is a Power BI Admin.

The Get-PowerBIActivityEvent cmdlet is a little quirky (at least, to me it is). But hey, this is the first version of the cmdlet, so let’s file items on GitHub with how it could be improved. In the meantime, let’s check out how to use it, and why it’s better than the Search-UnifiedAuditLog cmdlet in the long run.

Let’s go through some limitations:

  1. You must be granted the Power BI Admin role.
  2. You must select a timeframe within a single day, and by day, I mean date. You cannot pick a 24-hour period which spans two different days. You can’t even pick a 1-hour period which spans two days.
  3. You have to use a very specific date format. Quoting from the Help files it says: “It should be in UTC format and ISO 8601 compliant“.
  4. It only outputs the results as either a JSON String or a JSON object.

The good news?

  1. I took care of limitations 2 & 3 in the above list for you.
  2. The Get-PowerBIActivityEvent cmdlet is not limited to outputting only 5,000 rows, or so I’m told. I don’t actually have a tenant with over 5,000 Power BI Audit Log Events in a single day, so I can’t verify.
  3. When you choose to have the output as a JSON String, it’s farily easy to get the file imported into Power BI Desktop. Maybe 4 or 5 steps? Hopefully, my friend Reza Rad ( blog | twitter ) can chime in with an easy to follow blog post on how to do that.

I have put together two options for you and posted them in a Gist. The first option goes through the last 90 days of your Power BI Audit Log and creates a separate .json file for each day. The second option goes through the same 90 days of your Power BI Audit Logs, but this time it puts everything into a single file. Pick the approach that works best for you.

Please Share This:

You may also like:

15 Responses

  1. Hi there, I get an error. All logging is enabled at tenant level within Power BI so not sure whats going on here:

    Get-PowerBIActivityEvents : Microsoft.PowerBI.Commands.Profile.Errors.PowerBIRestExceptionRecord
    At line:1 char:1
    + Get-PowerBIActivityEvents
    + ~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo : NotEnabled: (Microsoft.Power…BIActivityEvent:GetPowerBIActivityEvent) [Get-PowerBIActivityEvent], Exception
    + FullyQualifiedErrorId : Microsoft.PowerBI.Commands.Profile.Errors.PowerBIRestExceptionRecord,Microsoft.PowerBI.Commands.Admin.GetPowerBIActivityEvent

    1. Gilbert,
      Thanks, I’m glad you like the post. In my testing, when I received [] as the result, that was indicated there was no activity to report that day. If you’re receiving that result for a day where you know there’s activity, that may mean that there’s an issue with the service which supplies the data to the API/Get-PowerBIActivityEvent cmdlet.

        1. Gilbert, I’m having the same issue. When I pull for the past 30 days, I have hundreds of records for the first few weeks of September, but then it mysteriously stops on 9/26 and I have no data since then.

          Aaron, any idea why that would be? What were you referring to when you mentioned the service that supplies the data to the API?

          1. Jason and Gilbert,
            It looks like there must be an issue with one of the services. Can you try using this technique and see if that allows you to retrieve your Power BI Audit Logs?

            I’m not on the Power BI product team (or any product team for that matter) so I have limited information at this time.

  2. This is great, thanks! One little typo though – in your two code examples (but not in your code screenshot), you forgot the ‘s’ on the end of Get-PowerBIActivityEvents

    1. Thanks, glad you liked it.

      I’m also glad you’re paying lose attention. It’s not a typo though, they renamed the cmdlet and pushed out a new version of the module. (PowerShell cmdlets aren’t supposed to be named in the plural.) Run Update-Module MicrosoftPowerBIMgmt -WhatIf and you will probably see that v 1.0.802 is waiting for you

      1. Thanks! I’m pretty new to the PowerShell world, so the nuances are interesting. I ran the update you recommended and tried both the singular and plural versions of the cmdlet and both work! Maybe there’s a transition period for those who started using the plural version? I can’t imagine they’d keep both hanging around.

        1. Yes, they added an alias to the module named Get-PowerBIActivityEvents which simply points to theGet-PowerBIActivityEvent cmdlet. You can see this for yourself by running: Get-Command -Module MicrosoftPowerBIMgmt*

          Make sure you include that star on the end, otherwise you’ll get nothing back.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Follow:

Subcribe to Blog Via Email

Enter your email address to subscribe to this blog and receive notifications of new posts by email.

What I'm Saying on Twitter

Subscribe via feedburner

%d bloggers like this: