AuditRecordsTeamsRecordingsUploads.PS1

# AuditRecordsTeamsRecordingsUploads.PS1
# A script to show how to use audit records in the Office 365 audit log to track uploads of Teams meeting recordings

$Status = Get-ConnectionInformation -ErrorAction SilentlyContinue
If (!($Status)) {
  Connect-ExchangeOnline -SkipLoadingCmdletHelp 
}

# Start and end date for the audit scan. By default, we look for 14 days, but you can choose 
# any value you like up to 365 (assuming Office 365 E5)
$StartDate = (Get-Date).AddDays(-180); $EndDate = (Get-Date) # Set your own date span here!
$OutputCSVFile = "C:\temp\AuditEventsTeamsRecordings.csv"

# Find the audit records
[array]$Records = (Search-UnifiedAuditLog -Operations FileUploaded, FileModified -StartDate `
   $StartDate -EndDate $EndDate -Formatted -ResultSize 5000 -SessionCommand ReturnLargeset)

If (!($Records)) {
   Write-Host "No audit records found - exiting!"; break
}
$Records = $Records | Sort-Object {$_.CreationDate -as [datetime]}

$TaggedRecordings = [System.Collections.Generic.List[Object]]::new() 	
ForEach ($Rec in $Records) {
   $AuditData = $Rec.AuditData | ConvertFrom-Json
   If (($AuditData.SourceFileExtension -eq "mp4") -and ($AuditData.SourceRelativeUrl -like "*/Recordings")) { 
      $RecordingFileName = $AuditData.SourceFileName
      $DateLoc = $RecordingFileName.IndexOf("-202")
      If ($DateLoc -eq -1) {$Topic = $RecordingFileName} Else {$Topic = $RecordingFileName.SubString(0,$DateLoc)}
      $DataLine = [PSCustomObject] @{
         Workload            = $AuditData.Workload
         Date                = $Rec.CreationDate
         User                = $Rec.UserIds
         Recording           = $RecordingFileName
         "Meeting title"     = $Topic
         Site                = $AuditData.SiteURL
         FullURL             = $AuditData.ObjectId
         Folder              = $AuditData.SourceRelativeURL
         Operation           = $Rec.Operations }
    $TaggedRecordings.Add($DataLine) 

   } #End If
} #End For

# Generate the list of audit events for Teams recordings
$UploadedMeetings = $TaggedRecordings | Where-Object {$_.Recording -notlike "*~tmp*"}
$UploadedMeetings | Out-GridView
$UploadedMeetings | Export-CSV -NoTypeInformation $OutputCSVFile


# An example script used to illustrate a concept. More information about the topic can be found in the Office 365 for IT Pros eBook https://gum.co/O365IT/
# and/or a relevant article on https://office365itpros.com or https://www.practical365.com. See our post about the Office 365 for IT Pros repository # https://office365itpros.com/office-365-github-repository/ for information about the scripts we write.

# Do not use our scripts in production until you are satisfied that the code meets the need of your organization. Never run any code downloaded from the Internet without
# first validating the code in a non-production environment.