Find app consent grants

Connect-ExchangeOnline -SkipLoadingCmdletHelp
Connect-MgGraph -Scopes Application.Read.All -NoWelcome

param(
    [string] $AppId = "$Auditdata.ObjectId.Split(";")[0]",
    [int] $LookbackDays = 90
)
 
$Status = Get-ConnectionInformation -ErrorAction SilentlyContinue
If (!($Status)) {
  Connect-ExchangeOnline -SkipLoadingCmdletHelp
}
# Connect to Graph SDK to get application information
Connect-MgGraph -Scopes Application.Read.All -NoWelcome
 
[array]$Apps = Get-MgApplication -All
[array]$Sps = Get-MgServicePrincipal -All
$SPHash = @{}
ForEach ($SP in $SPs) {
  $SPHash.Add($SP.AppId,$SP.DisplayName)
}
$AppHash = @{}
ForEach ($App in $Apps) {
  $AppHash.Add($App.AppId,$App.DisplayName)
}
 
Write-Host "Searching for audit records..."
[array]$Records = Search-UnifiedAuditLog -StartDate ((Get-Date).AddDays(-$LookbackDays)) -EndDate ((Get-Date).AddDays(1)) `
  -ResultSize 5000 -Operations "Consent to application." -SessionCommand ReturnLargeSet
 
If ($Records) {
   $Report = [System.Collections.Generic.List[Object]]::new() # Create output file for report
   ForEach ($Rec in $Records) {
      $AppName = $Null
      $Auditdata = $Rec.Auditdata | ConvertFrom-Json
      $AppName = $SpHash[$AppId]
      If (!($AppName)) {
          $AppName = $AppHash[$AppId]
      }
      $Tag =  $Auditdata.ModifiedProperties | Where-Object {$_.Name -eq "ConsentContext.Tags"} | Select-Object -ExpandProperty NewValue
      If ($Tag -eq "WindowsAzureActiveDirectoryIntegratedApp") {
          $AppType = "Enterprise app"
      } Else {
          $AppType = "Registered app"
      }
      $ReportLine = [PSCustomObject]@{
         User            = $Auditdata.UserId
         Date            = Get-Date ($Auditdata.CreationTime) -format g
         ObjectId        = $Auditdata.ObjectId
         AppId           = $AppId
         AppName         = $AppName
         AdminConsent    = $Auditdata.ModifiedProperties | Where-Object {$_.Name -eq "ConsentContext.IsAdminConsent"} | Select-Object -ExpandProperty NewValue
         ForAllUsers     = $Auditdata.ModifiedProperties | Where-Object {$_.Name -eq "ConsentContext.OnBehalfOfAll"} | Select-Object -ExpandProperty NewValue
         AppType            = $AppType
         Details        =  $Auditdata.ExtendedProperties | Where-Object {$_.Name -eq "additionalDetails"} | Select-Object -ExpandProperty Value }
      $Report.Add($ReportLine)
    }
}
 
$Report = $Report | Sort-Object {$_.Date -as [datetime]}
$Report | Out-GridView