Report on Sway usage in Office 365

Report on Sway usage in Office 365

When asked to create a report of Sway usage for a group of users within Office 365, there is no dedicated Sway admin portal so we need some Powershell commands and some audit report data to achieve this.

1. Access https://protection.office.com
2. Sign in using your work or school account.
3. In the left pane of the Security & Compliance Center, click Search, and then click Audit log search.
   The Audit log search page is displayed.
4. Configure your search criteria as 'Viewed Sway'
5. Enter the start and finish dates of your search window
6. Click Search to begin the audit log search process
7. When the search is completed, the results will be displayed in the browser. We need to export these to CSV by clicking the Export Results drop down list.
8. Open the CSV file in Excel and highlight the data in the users column and copy this to the clipboard.
9. Open Powershell ISE and issue the following commands:

$users = get-clipboard

$users|where{$_ -like "user@domain.gov.uk"}|sort -unique

This will return a list of users from a particular domain who have accessed Sway