Post

My whining thread :p I couldn't find any reports, queries, etc., to help us assess impact :( The responsibilty to discover licensing costs was left to the customer with sparse instructions to go figure it out... "Just look at your audit logs!" learn.microsoft.com/en-us/entra/...

Many orgs have massive audit logs, so pulling them all back is not the best way to do this, except... We can't actually filter on the things you want to for this, and the docs aren't clear which loggedByService corresponds to which API calls :-/ learn.microsoft.com/en-us/graph/...

So now I'm stuck pulling ALL audit logs back and post processing, which brings me to my next "what the heck?" moment This is no ordinary hashtable, they murdered this thing. It's arrays with unrelated key/value pairs inside of it, plus escaped quotes... What a pain to work with