Export a time-bounded Entra sign-in report
Documentation: Microsoft Learn
Query sign-ins from the last 24 hours and export selected fields, including a flattened status code, to CSV.
Example reviewed 1 October 2026 · Illustrative output · Not a live system check
The script
$Since = (Get-Date).ToUniversalTime().AddDays(-1).ToString('yyyy-MM-ddTHH:mm:ssZ')
Get-MgAuditLogSignIn -Filter "createdDateTime ge $Since" -All -ErrorAction Stop |
Select-Object CreatedDateTime, UserDisplayName, UserPrincipalName, AppDisplayName,
@{Name='ErrorCode'; Expression={$_.Status.ErrorCode}} |
Export-Csv -LiteralPath './entra-sign-ins.csv' -NoTypeInformation -Encoding UTF8Script reader
Inspect before you run
Inspect the script below. It does not run in this browser.
Inspection only — no command has run.
Show reference output
Encoding note: -Encoding UTF8 writes with BOM on Windows PowerShell 5.1 and without BOM on PowerShell 7+. If a picky importer chokes on the file, this version difference is the first thing to check.
Fictional reference snapshot · 03 October 2026, 09:00 UTC. This is an example result, not a check of your systems.
No console output: Export-Csv writes ./entra-sign-ins.csv. Fictional file preview (snapshot: 03/10/2026 09:00 UTC): "CreatedDateTime","UserDisplayName","UserPrincipalName","AppDisplayName","ErrorCode" "2026-10-03T08:30:00Z","Demo Learner","learner@example.test","Training Portal","0"
Inspect this example’s structure
Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.
$Since = (Get-Date).ToUniversalTime().AddDays(-1).ToString('yyyy-MM-ddTHH:mm:ssZ')
Get-MgAuditLogSignIn -Filter "createdDateTime ge $Since" -All -ErrorAction Stop |
Select-Object CreatedDateTime, UserDisplayName, UserPrincipalName, AppDisplayName,
@{Name='ErrorCode'; Expression={$_.Status.ErrorCode}} |
Export-Csv -LiteralPath './entra-sign-ins.csv' -NoTypeInformation -Encoding UTF8- Stage 1$Since
Positional values or no named parameters - Stage 2Select-Object
Positional values or no named parameters - Stage 3Export-Csv
-LiteralPath -NoTypeInformation -Encoding
Illustrative output
This example shows the expected shape for fictional data. Your values and formatting will differ.
# Illustrative contents of entra-sign-ins.csv (no console rows are expected): "CreatedDateTime","UserDisplayName","UserPrincipalName","AppDisplayName","ErrorCode" "2026-10-01T07:00:00Z","Alex Chen","alex@contoso.example","Microsoft 365","0"
How it works
The UTC lower bound defines the reporting window. -All requests all result pages for that filter. The projection flattens Status.ErrorCode so CSV does not contain a nested status-object string. Export-Csv writes a file rather than returning the report rows to the console.
Before you run it
Use Microsoft.Graph.Reports and an authenticated Graph session with suitable audit-log permissions, consent and directory role where required. Sign-in log access and retention depend on tenant licensing and policy; check Microsoft’s current requirements. This example assumes authentication is already established.
Check the result
Open the CSV with Import-Csv, confirm the timestamps and compare a known event in the same reporting window. Treat nonzero codes as diagnostic evidence requiring interpretation. Protect exported sign-in data according to your organisation’s policy.
If nothing is returned
An empty successful query may reflect the selected window or available records. Permission, retention and query errors are separate conditions and must not be interpreted as no activity.