How to get Entra sign-in logs via Graph API

Graph API

If you need to export Entra ID sign-in logs and include details like UserAgent (which is not included when using native 'Download' option in Entra Portal), you can use below code based on Graph module. You'll need to have AuditLog.Read.All Graph API permission and Global Reader Entra Role.

Get-MgAuditLogSignIn -Filter "UserID eq 'ObjectId'" -all | Select CreatedDateTime, UserDisplayName, UserPrincipalName, IpAddress, `                                                                          @{N="NetworkNames"; E={$_.NetworkLocationDetails.NetworkNames}},`                                                                                 AppDisplayName, `                                                                                  ClientAppUsed,UserAgent,IsInteractive,ConditionalAccessStatus, `                                                                                  @{N="Error Code"; E={$_.Status.ErrorCode}},`                                                                                  @{N="FailureReason"; E={$_.Status.FailureReason}},`                                                                                  @{N="AdditionalDetails"; E={$_.status.AdditionalDetails}},`                                                                                   @{N="MFA AuthMethod"; E={$_.MfaDetail.AuthMethod}},`                                                                                  @{N="MFA AuthDetail"; E={$_.MfaDetail.AuthDetail}},`                                                                                  @{N="CountryOrRegion"; E={$_.Location.CountryOrRegion}},`                                                                                  @{N="State"; E={$_.Location.State}},`                                                                                  @{N="City"; E={$_.Location.City}},`                                                                                  @{N="Browser"; E={$_.DeviceDetail.Browser}},`                                                                                  @{N="DeviceId"; E={$_.DeviceDetail.DeviceId}},`                                                                                  @{N="DisplayName"; E={$_.DeviceDetail.DisplayName}},`                                                                                  @{N="IsCompliant"; E={$_.DeviceDetail.IsCompliant}},`                                                                                  @{N="IsManaged"; E={$_.DeviceDetail.IsManaged}},`                                                                                  @{N="OperatingSystem"; E={$_.DeviceDetail.OperatingSystem}},`                                                                                  @{N="TrustType"; E={$_.DeviceDetail.TrustType}}