I have created a script that uses the Microsoft Graph to report directory activity for the tenant as shown above. You’ll find it here:
https://github.com/directorcia/Office365/blob/master/graph-diraudit-get.ps1
along with the documentation here:
https://github.com/directorcia/Office365/wiki/Report-directory-activity-in-a-tenant
You will need to have the Microsoft Graph PowerShell module installed and up to date.
The first time you run the script you maybe prompted to login to your tenant and then you may also be asked to provide permissions This script requires:
AuditLog.Read.All
Directory.Read.All
which you may need to consent to the first time.
After the script executes you should see an output as shown above showing the logging service, activity, result, operation, category and time stamp.
You can also use the –csv command line option to put the results to a CSV file in the parent directory.
CIAOPS 