Deploying Microsoft 365 Teamwork: Exam MS-300 Guide

Filtering data

You can reference the properties inside your converted JSON object data using standard PowerShell dot-notation.

For example, if we wanted to search for all of the activities that happened inside the https://ms300demo.sharepoint.com/sites/MS300ExternalDemo site, we could use something as simple as the following:

$AuditLog | ? { ($_.AuditData | ConvertFrom-Json).SiteUrl -eq "https://ms300demo.sharepoint.com/sites/MS300ExternalDemo"}

The output of the preceding command can be seen in the following screenshot:

Once you've narrowed down the objects that you want, you can send them to a new CSV for further examination. In environments ...