How to export the audit log in Microsoft Entra ID

Before you start

Use an account in the Reports Reader, Security Reader or Security Administrator role. The PowerShell example requests AuditLog.Read.All; your organisation may require administrator consent. Microsoft lists Microsoft Entra ID P1 or P2 for reading the logs through Microsoft Graph, while the download in the admin centre works in every edition.

Know what you get. The log keeps 7 days without P1 or P2 and 30 days with them, and an upgrade doesn't bring back days that have already gone. Times are in UTC. The examples read and export; they change nothing.

Option 1

Export the audit log with PowerShell

Install the modules once, then connect and export the last 7 days of entries, newest first. The date filter runs in Microsoft Graph, so only those days come back.

# Install once, if the modules are not already installed.
Install-Module Microsoft.Graph.Authentication, Microsoft.Graph.Reports -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-MgGraph -Scopes 'AuditLog.Read.All' -NoWelcome
try {
    $days = 7
    $since = (Get-Date).ToUniversalTime().AddDays(-$days).ToString('yyyy-MM-ddTHH:mm:ssZ')
    $entries = @(Get-MgAuditLogDirectoryAudit -All -Filter "activityDateTime ge $since")
    $report = @($entries | Sort-Object ActivityDateTime -Descending | ForEach-Object {
        $by = $_.InitiatedBy.User.UserPrincipalName
        if (-not $by) { $by = $_.InitiatedBy.App.DisplayName }
        $targets = $_.TargetResources | ForEach-Object {
            if ($_.UserPrincipalName) { $_.UserPrincipalName } else { $_.DisplayName }
        }
        [pscustomobject]@{
            When     = $_.ActivityDateTime
            Activity = $_.ActivityDisplayName
            Result   = $_.Result
            By       = $by
            Target   = @($targets) -join '; '
            Category = $_.Category
            Service  = $_.LoggedByService
        }
    })
    if ($report.Count -eq 0) {
        Write-Output "No audit entries in the last $days days."
    } else {
        $report | Export-Csv -Path './entra-audit-log.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($report.Count) audit entries from the last $days days exported."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

By is the person who made the change, or the app when no person did. Target names what changed, such as a user or group, and Service is the part of Entra ID that logged it. Raise $days to 30, the most the log keeps, to read all of it. To keep a long record, run the script on a schedule and keep each CSV.

Find who deleted an account

Reconnect with Connect-MgGraph, then filter the log by its activity name.

# Run while connected to Microsoft Graph.
$filter = "activityDisplayName eq 'Delete user'"
Get-MgAuditLogDirectoryAudit -All -Filter $filter |
    Select-Object ActivityDateTime, @{ N = 'By'; E = { $_.InitiatedBy.User.UserPrincipalName } },
        @{ N = 'Account'; E = { $_.TargetResources[0].UserPrincipalName } }

Change the activity to Delete group or Delete application for those objects.

Option 2

Download the audit log in the admin centre

1. Sign in to the Microsoft Entra admin centre for the correct tenant as at least a Reports Reader.
2. Go to Entra ID > Monitoring & health > Audit logs.
3. Set the filters at the top of the list first, such as the date range, so the file holds only what you need.
4. Select Download, choose CSV or JSON as the Format, optionally give the file a name, then select Download.

This suits a one-off download. A file holds up to 250,000 audit records, a large download can time out in the browser, and the file always has every column, whatever the list showed. For a regular export, use PowerShell or a report.

Common questions

How do I keep the audit log for longer than 30 days?

Send it to an Azure storage account through Azure Monitor, or, with an E5 licence such as Microsoft 365 E5, keep it in Microsoft Purview Audit (Premium). Otherwise, export it before the days fall out of the log.

Why can't I see changes from before we bought P1?

Retention changes aren't retroactive. After an upgrade from Microsoft Entra ID Free, only the last 7 days are there, and anything older that wasn't exported is gone.

Where are the failed sign-ins?

In the sign-in log, not the audit log. Reading it through Microsoft Graph needs Microsoft Entra ID P1 or P2; see how to find failed sign-ins.