Get-PurviewAuditLogReport

<#
.SYNOPSIS
    Searches the unified audit log and exports results to CSV.

.DESCRIPTION
    Wraps Search-UnifiedAuditLog with sensible defaults for a specific
    user or activity type over a date range, and exports results to
    CSV, faster than repeatedly adjusting filters in the compliance
    portal UI.

.PARAMETER UserPrincipalName
    Optional. Filter to a specific user's activity.

.PARAMETER Days
    How many days back to search. Defaults to 7.

.EXAMPLE
    .\Get-PurviewAuditLogReport.ps1 -UserPrincipalName jane.doe@contoso.com -Days 14

.NOTES
    Requires the ExchangeOnlineManagement module connected to Security &
    Compliance PowerShell (Connect-IPPSSession).

.AUTHOR
    Shehryar Hassan
#>

param(
    [string]$UserPrincipalName,
    [int]$Days = 7,
    [string]$ExportPath = (Get-Location).Path
)

$since = (Get-Date).AddDays(-$Days)
$params = @{ StartDate = $since; EndDate = (Get-Date); ResultSize = 5000 }
if ($UserPrincipalName) { $params.UserIds = $UserPrincipalName }

$results = Search-UnifiedAuditLog @params

$file = Join-Path $ExportPath "audit-log-search_$(Get-Date -Format yyyyMMdd_HHmmss).csv"
$results | Export-Csv -Path $file -NoTypeInformation
Write-Host "Exported $($results.Count) audit event(s) to $file" -ForegroundColor Cyan