Microsoft 365
Quick Microsoft Graph PowerShell pivots for directory and sign-in investigation.
Connect with audit-read permissions
Connect-MgGraph -Scopes 'AuditLog.Read.All','Directory.Read.All'
Recent sign-ins
Get-MgAuditLogSignIn -Top 20
Risky users
Directory audit events
Get-MgAuditLogDirectoryAudit -Top 20