Public/ConvertFrom-NSPM365AuditCsv.ps1
|
function ConvertFrom-NSPM365AuditCsv { <# .SYNOPSIS Reads a Microsoft 365 audit CSV export and parses its AuditData JSON. #> [CmdletBinding()] param([Parameter(Mandatory)][ValidateNotNullOrEmpty()][string]$Path) $resolved = (Resolve-Path -LiteralPath $Path -ErrorAction Stop).ProviderPath $rowNumber = 1 foreach ($row in (Import-Csv -LiteralPath $resolved -ErrorAction Stop)) { $rowNumber++ if (-not $row.PSObject.Properties['AuditData']) { throw "AuditData column is missing at row $rowNumber." } $audit = $null if (-not [string]::IsNullOrWhiteSpace($row.AuditData)) { try { $audit = $row.AuditData | ConvertFrom-Json -ErrorAction Stop } catch { throw "Invalid AuditData JSON at row $rowNumber`: $($_.Exception.Message)" } } [pscustomobject]@{ RecordId = $row.RecordId CreationDate = $row.CreationDate RecordType = $row.RecordType Operation = $row.Operation UserId = $row.UserId AuditData = $audit _Raw = $row } } } |