Commands › Exchange Online

Get-DlpIncidentDetailReport

Exchange Online ExchangeOnlineManagement Get-*

**Note**: This cmdlet will be retired. Use the Export-ActivityExplorerData instead. Use the Get-DlpIncidentDetailReport cmdlet to view the details of incidents that happened in the last 30 days.

Quick start script

# Get-DlpIncidentDetailReport — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Run and inspect
Get-DlpIncidentDetailReport | Format-List

# 3. Export for evidence / drift tracking
Get-DlpIncidentDetailReport | Export-Clixml .\DlpIncidentDetailReport-$(Get-Date -Format yyyyMMdd).xml

Syntax

Get-DlpIncidentDetailReport
 [-Action <MultiValuedProperty>]
 [-Actor <MultiValuedProperty>]
 [-DlpCompliancePolicy <MultiValuedProperty>]
 [-DlpComplianceRule <MultiValuedProperty>]
 [-EndDate <System.DateTime>]
 [-EventType <MultiValuedProperty>]
 [-Page <Int32>]
 [-PageSize <Int32>]
 [-Source <MultiValuedProperty>]
 [-StartDate <System.DateTime>]
 [<CommonParameters>]

Parameters (10)

ParameterTypeRequiredWhat it controls
-Action MultiValuedProperty The Action parameter filters the report by the action taken by DLP policies. Valid values are:
-Actor MultiValuedProperty The Actor parameter filters the report by the user who last modified the item. You can enter multiple users separated by commas.
-DlpCompliancePolicy MultiValuedProperty The DlpCompliancePolicy parameter filters the report by the name of the DLP compliance policy. You can specify multiple policies separated by commas.
-DlpComplianceRule MultiValuedProperty The DlpComplianceRule parameter filters the report by the name of the DLP compliance rule. You can specify multiple rules separated by commas.
-EndDate DateTime The EndDate parameter specifies the end date of the date range.
-EventType MultiValuedProperty The EventType parameter filters the report by the event type. Valid values are:
-Page Int32 The Page parameter specifies the page number of the results you want to view. Valid input for this parameter is an integer between 1 and 1000. The default value is 1.
-PageSize Int32 The PageSize parameter specifies the maximum number of entries per page. Valid input for this parameter is an integer between 1 and 5000. The default value is 1000.
-Source MultiValuedProperty The Source parameter filters the report by workload. Valid values are:
-StartDate DateTime The StartDate parameter specifies the start date of the date range.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.