invictus-ir/Microsoft-Extractor-Suite

[WARNING] You must call Connect-Azure before running this script after successfully connecting to the Azure AD tenant

Closed this issue · 8 comments

AnthoLaMalice commented

Dear,

I am facing a problem when I try to use your tool to extract AAD sign in logs.

After "successfully" connecting to my Azure AD tenant, the tool still tells me that I need to call Connect-Azure.

However, I can't be sure that I've successfully logged in, because after entering the valid credentials, there's nothing displayed.

Is there some kind of verbose that could help me understand what's wrong?
image

I also tried using the Connect-M365 cmdlet to retrieve all the MailboxRules and it worked, so I think the problem is only with Connect-Azure.
image

Kind regards

Deleted user commented

Hi there, thanks for reaching out sorry to hear that it's not working. It might have something to do with the Azure AD module, because it needs a specific version. In order to test if you have access to the right modules can you do:

  • Connect-Azure
  • After you've connected try running Get-AzureADAuditSignInLogs
  • This is the underlying cmdlet that is used to retrieve the SignInLogs.
    Let me know what you get back.
AnthoLaMalice commented

I just tried it and it seems like the command doesn't exist within your tool
image

Deleted user commented

So whenever you call 'GetAdSignInLogs' in our tool it will in the backend call 'GetAzureAdAuditSignInLogs'. This error means that you don't have that command available which can mean several things.

  1. You don't have the right permissions.
  2. You're not using the AzureAD Preview module.
    Most likely it's number two which you can double check by running the following command

Get-InstalledModule -Name AzureADPreview

You should see that the AzureADPreview module is installed. If it's not installed run:
Install-Module -Name AzureADPreview -RequiredVersion 2.0.2.149 -Force -AllowClobber

AnthoLaMalice commented

Indeed it was not installed. However it did not fix the issue :/
image

Deleted user commented

Ok please run the command Get-AzureADAuditSignInLogs and share the output

Deleted user commented

Ok sometimes there are issues when using the normal AzureAD module and the preview one. We've had a similar issue #6 please follow the steps to test.
Before you do so please exit out of the current session and start a brand new one. Then make sure the AzureADPreview module is available and last but not least check the commands inside the AzureADPreview module to make sure you can call(Get-AzureADAuditSignInLogs).

JoeyInvictus commented

Hi @AnthoLaMalice, Have you managed to get it working?