Report audit recs guest doc access

Connect-ExchangeOnline -SkipLoadingCmdletHelp

param(
    [int] $LookbackDays = 90
)
 
[array]$Modules = Get-Module | Select-Object -ExpandProperty Name
If ("ExchangeOnlineManagement" -notin $Modules) {
    Write-Host "Loading Exchange Online Management module"
    Connect-ExchangeOnline -SkipLoadingCmdletHelp
}
 
Write-Host "Searching for SharePoint file access audit records..."
[array]$Records = Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-$LookbackDays) -EndDate (Get-Date).AddDays(+1) `
  -Operations FileAccessed -ResultSize 5000 -Formatted -SessionCommand ReturnLargeSet
If ($Records.Count -eq 0) {
  Write-Host "No SharePoint file access records found for guest users."
  Break
}
 
# Remove any duplicates and sort by date and extract the records for guest users
$Records = $Records | Sort-Object Identity -Unique | Where-Object {$_.UserIds -Like "*#EXT#*" } | Sort-Object { $_.CreationDate -as [datetime]} -Descending
 
Write-Host "Processing" $Records.Count" SharePoint file access audit records..."
$Report = [System.Collections.Generic.List[Object]]::new()
ForEach ($Rec in $Records) {
  $AuditData = ConvertFrom-Json $Rec.Auditdata
  If ($AuditData.SourceFileName -NotLike "*aspx*" -And $AuditData.SourceFileName -NotLike "*jpg*" ) {
    $ReportLine = [PSCustomObject]@{
      TimeStamp   = $Rec.CreationDate
      User        = $Rec.UserIds
      Action      = $AuditData.Operation
      Workload    = $AuditData.Workload
      URL         = $AuditData.SiteUrl
      Document    = $AuditData.SourceFileName
    }
    $Report.Add($ReportLine)
  }
}
 
$Report | Out-GridView