Download Power BI Audit Logs with the New Get-PowerBIActivityEvents cmdlet

Earlier this week a new version of the MicrosoftPowerBIMgmt module was made available on the PowerShell Gallery. Two new cmdlets were included in the module Remove-PowerBIReport and Get-PowerBIActivityEvents. The Remove-PowerBIReport cmdlet was written by my coworker [and new best friend] Caroline Bell ( twitter ). Let’s take a look at both of these new cmdlets.

Remove-PowerBIReport

The Remove-PowerBIReport cmdlet can come in handy in CI/CD scenarios with Power BI. Let’s say you have copied a Report from a QA Workspace over to a Production Workspace, and chose not to overwrite the Dataset in the Production Workspace. (For clarity: In this scenario, the Dataset in the QA Workspace is connected to a QA database, while the Dataset in the Prod Workspace is connected to a Production database. And you want it to stay that way). This is a great way to test your Reports before you release them for everyone to see, but you’re left with the old version of the Report in that Production Workspace when you’re done. The Remove-PowerBIReport cmdlet can remove the old version of that(those) Report(s) in a Production Workspace after you have copied over the version from QA.

I have posted a Gist to demonstrate this scenario & technique, but I haven’t had time to blog about it just yet. Maybe in a week or two.

Get-PowerBIActivityEvents

You can now download Power BI Audit Logs using the new Get-PowerBIActivityEvents cmdet. This cmdlet saves you from having to be granted “Audit Logs or View-Only Audit Logs role in Exchange Online” permissions in Office 365. Instead, as long as you’re a Power BI Admin, you will be able to retrieve the audit logs as-is. This can be extremely useful for Power BI Governance, because being granted the View-Only Audit Logs role gives you access to all audit records across Office 365. Some organizations will not grant that capability to everyone who is a Power BI Admin.

The Get-PowerBIActivityEvents cmdlet is a little quirky (at least, to me it is). But hey, this is the first version of the cmdlet, so let’s file items on GitHub with how it could be improved. In the meantime, let’s check out how to use it, and why it’s better than the Search-UnifiedAuditLog cmdlet in the long run.

Let’s go through some limitations:

1. You must be granted the Power BI Admin role.
2. You must select a timeframe within a single day, and by day, I mean date. You cannot pick a 24-hour period which spans two different days. You can’t even pick a 1-hour period which spans two days.
3. You have to use a very specific date format. Quoting from the Help files it says: “It should be in UTC format and ISO 8601 compliant“.
4. It only outputs the results as either a JSON String or a JSON object.

The good news?

1. I took care of limitations 1 & 2 in the above list for you.
2. The Get-PowerBIActivityEvents cmdlet is not limited to outputting only 5,000 rows, or so I’m told. I don’t actually have a tenant with over 5,000 Power BI Audit Log Events in a single day, so I can’t verify.
3. When you choose to have the output as a JSON String, it’s farily easy to get the file imported into Power BI Desktop. Maybe 4 or 5 steps? Hopefully, my friend Reza Rad ( blog | twitter ) can chime in with an easy to follow blog post on how to do that.

I have put together two options for you and posted them in a Gist. The first option goes through the last 90 days of your Power BI Audit Log and creates a separate .json file for each day. The second option goes through the same 90 days of your Power BI Audit Logs, but this time it puts everything into a single file. Pick the approach that works best for you.