Commands › Exchange Online

Get-CompromisedUserDetailReport

Exchange Online ExchangeOnlineManagement Get-*

Return detailed information about compromised users for the last 10 days.

Quick start script

# Get-CompromisedUserDetailReport — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Run and inspect
Get-CompromisedUserDetailReport | Format-List

# 3. Export for evidence / drift tracking
Get-CompromisedUserDetailReport | Export-Clixml .\CompromisedUserDetailReport-$(Get-Date -Format yyyyMMdd).xml

Syntax

Get-CompromisedUserDetailReport
 [-Action <MultiValuedProperty>]
 [-EndDate <System.DateTime>]
 [-Page <Int32>]
 [-PageSize <Int32>]
 [-StartDate <System.DateTime>]
 [<CommonParameters>]

Parameters (5)

Parameter	Type	What it controls
-Action	MultiValuedProperty	The Action parameter filters the results by the compromised user status. Valid values are:
-EndDate	DateTime	The EndDate parameter specifies the end date of the date range.
-Page	Int32	This parameter is reserved for internal Microsoft use.
-PageSize	Int32	The PageSize parameter specifies the maximum number of entries per page. Valid input for this parameter is an integer between 1 and 5000. The default value is 1000.
-StartDate	DateTime	The StartDate parameter specifies the start date of the date range.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.