[BUG] Documentation update Get-PnPUnifiedAuditLog Start and end times should be UTC Dates.

[SPDEVGUY]

Reporting an Issue or Missing Feature

Bug (Documentation incorrect)

https://pnp.github.io/powershell/cmdlets/Get-PnPUnifiedAuditLog.html

Example 1
Get-PnPUnifiedAuditLog -ContentType SharePoint -StartTime (Get-Date).AddDays(-2) -EndTime (Get-Date).AddDays(-1)

Expected behavior

Documentation is missing the fact that start and end times are UTC.

Actual behavior

Example 1 should be like this and Start and End times documentation should make note that dates provided are UTC times.

$utcNow = Get-Date -asUtc
Get-PnPUnifiedAuditLog -ContentType SharePoint -StartTime ($utcNow).AddDays(-2) -EndTime ($utcNow).AddDays(-1)

[gautamdsheth]

@reshmee011 - can you check this since you recently worked on some improvements around this ? When we first created this cmdlet, we didn't require dates to be in UTC , but maybe things have changed ?

[reshmee011]

@gautamdsheth , that's right the date and times need to be in UTC, I discovered it while working with cli for m365 equivalent as the dates are being passed as string and needed to be formatted to ISO 8601 string (2024-02-16)
https://pnp.github.io/cli-microsoft365/cmd/purview/auditlog/auditlog-list/
Get-Date -uFormat '%Y-%m-%d'

The PnP PowerShell accepts date parameters , hence conversion not required.
https://reshmeeauckloo.com/posts/powershell-get-log-sharepoint-dlp-exchange-entra-pnpunifiedlog/

Worth mentioning the required format.

[gautamdsheth]

@reshmee011 - thanks for confirming ! Could you also please update the PR as well to mention this ? :)

[reshmee011]

@gautamdsheth : I have updated the PR to include the note about passing the start and end date in ISO 8601 format if passed as string format.

[gautamdsheth]

Thanks @SPDEVGUY and @reshmee011 , docs updated. Closing this.

[SPDEVGUY]

@gautamdsheth / @reshmee011
The command accepting the dates should also point out that the date objects passed to the command should be UTC based.

$forDay = (Get-date)
$fromDate = Get-Date -Year ($forDay.Year) -Month ($forDay.Month) -Day ($forDay.Day) -hour 0 -minute 0 -second 0 -millisecond 0
$toDate = $fromDate.AddMinutes(60)


$fromDateUtc = get-date -date ($fromDate) -asUtc
$toDateUtc = get-date -date ($toDate) -asUtc

Get-PnPUnifiedAuditLog -ContentType SharePoint -StartTime $fromDateUtc -EndTime $toDateUtc

<# Will not return the same as  #>

Get-PnPUnifiedAuditLog -ContentType SharePoint -StartTime $fromDate -EndTime $toDate

In order to get the actual latest entries (which my app follows in 5 min slices) I needed to use the utc time now less 5 mins to actually get things that happened in the last 5 minutes.

You could probably just make this clear by changing your example to include " -asUtc"

Get-PnPUnifiedAuditLog -ContentType SharePoint -StartTime (Get-Date -asUtc).AddDays(-2) -EndTime (Get-Date -asUtc).AddDays(-1)

[reshmee011]

I apologize for any inconvenience caused by the oversight. As I am based in the UK and use GMT, I didn’t fully appreciate the impact of non-UTC dates. Thank you for bringing this to my attention! 😊. I have submitted a PR to update the docs.