Report audit recs user sign ins

Connect-ExchangeOnline -SkipLoadingCmdletHelp

param(
    [int] $LookbackDays = 90
)
 
$Modules = Get-Module | Select-Object -ExpandProperty Name
If ("ExchangeOnlineManagement" -notin $Modules) {
    Write-Host "Loading Exchange Online Management module"
    Connect-ExchangeOnline -SkipLoadingCmdletHelp
}
 
[array]$Records = (Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-$LookbackDays) -EndDate (Get-Date).AddDays(+1)   -Operations  UserLoggedIn,  TeamsSessionStarted  -SessionCommand ReturnLargeSet -ResultSize 5000 -Formatted)
If ($Records.Count -eq 0) {
  Write-Host "No Audit records found for user logons."
  Break
}
# Remove any duplicates
$Records = $Records | Sort-Object Identity -Unique | Sort-Object { $_.CreationDate -as [datetime]} -Descending
Write-Host ("Processing {0} audit records..." -f $Records.count)
$Report = [System.Collections.Generic.List[Object]]::new()
ForEach ($Rec in $Records) {
  $AuditData = ConvertFrom-Json $Rec.Auditdata
  If ($AuditData.Workload -eq "MicrosoftTeams") {
      $Client =  $Auditdata.ObjectId
      $Status = "Succeeded"
  } Else {
      $Client = $AuditData.ExtendedProperties[0].Value
      $Status = $AuditData.ResultStatus
  }
  $ReportLine = [PSCustomObject]@{
    TimeStamp   = $Rec.CreationDate
    User        = $AuditData.UserId
    Action      = $AuditData.Operation
    Client      = $Client
    IpAddress   = $AuditData.ActorIpAddress
    Status      = $Status
    Workload    = $AuditData.Workload
  }
  $Report.Add($ReportLine)
}
$Report | Out-GridView