CloudKit

Tools, scripts and tips useful during Cloud Security Assessments.

Get-EntraInteractiveSignInIssues.ps1

Lists Entra ID interactive sign-ins that did not succeed (Interrupted or Failure) over the last N days as a console table, with an optional Excel export. Authenticates via Connect-MgGraph.

Requirements: Entra ID P1/P2 licensed tenant, delegated scope AuditLog.Read.All. Microsoft.Graph.Reports (and ImportExcel for -Excel) auto-install on first run.

Parameters

Parameter	Description
-Days	Days to look back, 1-30 (rolling window). Prompts if omitted.
-TenantId	Target tenant, GUID or domain (e.g. contoso.onmicrosoft.com).
-UseDeviceCode	Device-code auth for headless / SSH / Server Core hosts.
-MaxRows	Max rows printed to console (default 1000; summary always counts all).
-Excel	Also export the full result set to a timestamped .xlsx (CSV fallback).
-ExcelPath	Explicit .xlsx output path (implies -Excel).

Usage

# Prompt for the number of days
.\Get-EntraInteractiveSignInIssues.ps1

# Last 15 days, console only
.\Get-EntraInteractiveSignInIssues.ps1 -Days 15

# Last 30 days, export to a timestamped .xlsx in the current directory
.\Get-EntraInteractiveSignInIssues.ps1 -Days 30 -Excel

# Target a specific tenant and write to an explicit .xlsx path
.\Get-EntraInteractiveSignInIssues.ps1 -Days 7 -TenantId contoso.onmicrosoft.com -ExcelPath C:\Reports\contoso-signins.xlsx

# Headless / SSH host (device-code sign-in)
.\Get-EntraInteractiveSignInIssues.ps1 -Days 7 -UseDeviceCode

# Raise the console row cap
.\Get-EntraInteractiveSignInIssues.ps1 -Days 30 -MaxRows 5000