Report priority cleanup spo audit records

Connect-ExchangeOnline -ShowBanner:$false

param(
    [int] $LookbackDays = 10,
    [string] $StartDate = (Get-Date).AddDays(-$LookbackDays),
    [string] $EndDate = "Get-Date"
)
 
[array]$Modules = Get-Module | Select-Object Name
If ("ExchangeOnlineManagement" -notin $Modules.Name) {
    Write-Host "Connecting to Exchange Online..."
    Connect-ExchangeOnline -ShowBanner:$false
}
 
Write-Output "Scanning for Priority Cleanup audit records..."
[array]$Records = Search-UnifiedAuditLog -StartDate $StartDate -EndDate $EndDate -Formatted -SessionCommand ReturnLargeSet -ResultSize 5000 -Operations 'PriorityCleanupFileRecycled', 'PriorityCleanupTagApplied'
$Records = $Records | Sort-Object Identity -Unique
If ($Records.Count -eq 0) {
    Write-Host "No audit records found for Priority Cleanup operations"
    Break
} Else {
    $Records = $records | Sort-Object Identity -Unique | Sort-Object { $_.CreationDate -as [datetime]} -Descending
    Write-Host ("Processing {0} audit records..." -f $Records.Count)
}
 
$Records | Group-Object Operations -NoElement | Sort-Object Count | Format-Table Name, Count -AutoSize
 
# Report removed files
$PriorityCleanupReport = [System.Collections.Generic.List[Object]]::new()
ForEach ($Item in $Records) {
    $AuditData = $Item.AuditData | ConvertFrom-Json
    $ReportLine = [PSCustomObject][Ordered]@{
        TimeStamp       = Get-Date ($AuditData.CreationTime) -format 'dd-MMM-yyyy HH:mm'
        User            = $AuditData.UserId
        Action          = $AuditData.Operation
        ItemType        = $AuditData.ItemType
        SiteURL         = $AuditData.SiteURL
        Item            = $AuditData.SourceFileName
        Extension       = $AuditData.SourceFileExtension
        ObjectId        = $AuditData.ObjectId
        FileSizeBytes   = $AuditData.FileSizeBytes
        LabelName       = $AuditData.PolicyMatchInfo.LabelName
        LabelID         = $AuditData.PolicyMatchInfo.LabelId
    }
    $PriorityCleanupReport.Add($ReportLine)
}
 
$TaggedOperations = $PriorityCleanupReport | Where-Object { $_.Action -eq 'PriorityCleanupTagApplied' }
$MovedOperations = $PriorityCleanupReport | Where-Object { $_.Action -eq 'PriorityCleanupFileRecycled' }
Write-Host ""
Write-Host ("Found {0} Priority Cleanup Tag Applied operations" -f $TaggedOperations.Count)
$TaggedOperations | Group-Object SiteURL -NoElement | Sort-Object Count -Descending | Format-Table Name, Count
Write-Host ""
Write-Host ("Found {0} Priority Cleanup File Recycled operations" -f $MovedOperations.Count)
$MovedOperations | Group-Object SiteURL -NoElement | Sort-Object Count -Descending | Format-Table Name, Count
 
# Export the report as an Excel worksheet or CSV file
If (Get-Module ImportExcel -ListAvailable) {
    $ExcelGenerated = $true
    Import-Module ImportExcel -ErrorAction SilentlyContinue
    $ExcelOutputFile = ((New-Object -ComObject Shell.Application).Namespace('shell:Downloads').Self.Path) + "\PriorityCleanupReport.xlsx"
    If (Test-Path $ExcelOutputFile) {
        Remove-Item $ExcelOutputFile -ErrorAction SilentlyContinue
    }
    $PriorityCleanupReport | Export-Excel -Path $ExcelOutputFile -WorksheetName "Priority Cleanup" -Title ("Priority Cleanup Report {0}" -f (Get-Date -format 'dd-MMM-yyyy')) -TitleBold -TableName "PriorityCleanup"
} Else {
    $CSVOutputFile = ((New-Object -ComObject Shell.Application).Namespace('shell:Downloads').Self.Path) + "\PriorityCleanupReport.CSV"
    $PriorityCleanupReport  | Export-Csv -Path $CSVOutputFile -NoTypeInformation -Encoding Utf8
}
 
If ($ExcelGenerated) {
    Write-Output ("Excel worksheet output written to {0}" -f $ExcelOutputFile)
} Else {
    Write-Output ("CSV output file written to {0}" -f $CSVOutputFile)
}
 
Write-Output "All done - enjoy the Priority Cleanup data!"