@@ -50,7 +50,7 @@ function Push-BECRun {
5050 $ExtractResult = ' Successfully extracted logs from auditlog'
5151 }
5252 Write-Information ' Getting last sign-in'
53- Try {
53+ try {
5454 $URI = " https://graph.microsoft.com/beta/auditLogs/signIns?`$ filter=(userId eq '$SuspectUser ')&`$ top=1&`$ orderby=createdDateTime desc"
5555 $LastSignIn = New-GraphGetRequest - uri $URI - tenantid $TenantFilter - noPagination $true - verbose | Select-Object @ { Name = ' CreatedDateTime' ; Expression = { $ (($_.createdDateTime | Out-String ) -replace ' \r\n' ) } },
5656 id,
@@ -69,7 +69,7 @@ function Push-BECRun {
6969 # List all users devices
7070 $Bytes = [System.Text.Encoding ]::UTF8.GetBytes($SuspectUser )
7171 $base64IdentityParam = [Convert ]::ToBase64String($Bytes )
72- Try {
72+ try {
7373 $Devices = New-GraphGetRequest - uri " https://outlook.office365.com:443/adminapi/beta/$ ( $TenantFilter ) /mailbox('$ ( $base64IdentityParam ) ')/MobileDevice/Exchange.GetMobileDeviceStatistics()/?IsEncoded=True" - Tenantid $TenantFilter - scope ExchangeOnline
7474 } catch {
7575 $Devices = $null
@@ -143,10 +143,10 @@ function Push-BECRun {
143143 Write-Information ' Getting bulk requests'
144144 $GraphResults = New-GraphBulkRequest - Requests $Requests - tenantid $TenantFilter - asapp $true
145145
146- $PasswordChanges = ($GraphResults | Where-Object { $_.id -eq ' Users' }).body.value | Where-Object { $_.lastPasswordChangeDateTime -ge $startDate }
147- $NewUsers = ($GraphResults | Where-Object { $_.id -eq ' Users' }).body.value | Where-Object { $_.createdDateTime -ge $startDate }
148- $MFADevices = ($GraphResults | Where-Object { $_.id -eq ' MFADevices' }).body.value
149- $NewSPs = ($GraphResults | Where-Object { $_.id -eq ' NewSPs' }).body.value
146+ $PasswordChanges = ($GraphResults | Where-Object { $_.id -eq ' Users' }).body.value | Where-Object { $_.lastPasswordChangeDateTime -ge $startDate } ?? @ ()
147+ $NewUsers = ($GraphResults | Where-Object { $_.id -eq ' Users' }).body.value | Where-Object { $_.createdDateTime -ge $startDate } ?? @ ()
148+ $MFADevices = ($GraphResults | Where-Object { $_.id -eq ' MFADevices' }).body.value ?? @ ()
149+ $NewSPs = ($GraphResults | Where-Object { $_.id -eq ' NewSPs' }).body.value ?? @ ()
150150
151151
152152 $Results = [PSCustomObject ]@ {
0 commit comments