export-activityexplorerdata command using pagecookie

Niharika Ch 65 Reputation points
2025-04-28T09:49:51.84+00:00

Hi, i could see the current limitation to export the data from activity explorer is 10000 but i'm looking to export more than the mentioned limit. So i'm trying it via export-activityexplorerdata command and i could see that we can achieve using pagecookie and watermark in export-activityexplorerdata command. I'm pretty much new to Powershell so trying to use the script below but it is not exporting the full data? In addition to this, i'm trying to understand below points as well,

  • what does it mean to run the command in loop?
  • what is this 120 second validity for pagecookie?
Export-ActivityExplorerData - StartTime "04/27/2025" -EndTime "04/28/2025" -OutputFormat Json
$res=Export-ActivityExplorerData - StartTime "04/27/2025" -EndTime "04/28/2025" -PageSize 5000 -OutputFormat Json
#Run the following steps in loop until all results are fetched
while ($res.LastPage -ne $true)
{
  $pageCookie = $res.WaterMark
  $res = Export-ActivityExplorerData -StartTime "04/27/2025" -EndTime "04/28/2025" -PageSize 5000 -OutputFormat Json -PageCookie $pageCookie
  (($res.ResultData) | ConvertFrom-Json) | Sort Happened | Export-Csv -Path C:\Users\test\export.csv
}

Could someone help me understand or have you exported data more than 10000?

Microsoft Purview
Microsoft Purview
A Microsoft data governance service that helps manage and govern on-premises, multicloud, and software-as-a-service data. Previously known as Azure Purview.
1,545 questions
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Venkat Reddy Navari 1,585 Reputation points Microsoft External Staff
    2025-04-28T12:02:47.43+00:00

    Hi @Niharika Ch When using the Export-ActivityExplorerData cmdlet, you're correct that there's a 10,000-record limit per export. To export more data, you can use the -PageCookie and -Watermark parameters, which help paginate through the data.

    Let me address your specific questions:

    What does it mean to "run the command in a loop"?

    When exporting data beyond 10,000 records, you need to repeat the command multiple times to get additional "pages" of data. The PageCookie you receive with the first call lets you retrieve the next set of records.

    After the first Export-ActivityExplorerData call, you need to use the PageCookie from the previous result in subsequent calls.

    This process continues until the command no longer returns a PageCookie, which means you've retrieved all the data.

    In PowerShell, this is achieved by running the command in a loop, repeating the export call and passing the PageCookie each time until all records are fetched.

    What is the 120-second validity for PageCookie?

    Each PageCookie is valid for 120 seconds. If you don't use it within this time frame, it expires, and you'll need to start over with a new export process.

    The key here is to act fast between calls to avoid the expiration window.

    Ideally, you'll need minimal delay between the requests to ensure the PageCookie remains valid and you don't miss out on the data.

    Why might the existing scripts fail to export full data?

    There are several reasons why scripts may not export all the data:

    The script might not be looping properly to handle all the PageCookie values.

    If there's a delay and the PageCookie expires, it can prevent further exports.

    Missing error handling or session timeouts during large exports could also interrupt the process.

    To resolve these issues, the script needs to loop through the PageCookie values correctly and ensure it handles errors and timeouts, especially during large exports.

    Example Script for Exporting Full Data

    Here's an updated script that properly loops through all pages, handles errors, and exports the data to a CSV file:

    # Initial setup
    $exportName = "YourExportName"  # Replace with your export name
    $outputPath = "C:\Temp\ActivityExplorerData.csv"  # Adjust path if needed
    $watermark = $null
    $pageCookie = $null
    $allData = @()
    
    # Ensure connection to the Compliance Center
    Function Ensure-Connection {
        if (-not (Get-Command Get-ComplianceSearch -ErrorAction SilentlyContinue)) {
            Write-Host "Connecting to Compliance Center..." -ForegroundColor Yellow
            Connect-IPPSSession -ErrorAction Stop
        }
    }
    
    # Ensure we're connected
    Ensure-Connection
    
    try {
        do {
            # Prepare parameters for export
            $params = @{
                ExportName = $exportName
            }
            if ($watermark) { $params["Watermark"] = $watermark }
            if ($pageCookie) { $params["PageCookie"] = $pageCookie }
    
            # Execute export
            $result = Export-ActivityExplorerData @params
    
            # Save returned data
            if ($result.Data) {
                $allData += $result.Data
                Write-Host "Retrieved $($result.Data.Count) records. Total so far: $($allData.Count)" -ForegroundColor Green
            } else {
                Write-Host "No data returned in this batch." -ForegroundColor DarkYellow
            }
    
            # Update cookies for next page
            $pageCookie = $result.PageCookie
            $watermark = $result.Watermark
    
            # Optional minimal wait to avoid server overload
            Start-Sleep -Seconds 1
    
        } while ($pageCookie)
    
        # Export final data
        $allData | Export-Csv -Path $outputPath -NoTypeInformation -Encoding UTF8
        Write-Host "Export completed! Total records exported: $($allData.Count)" -ForegroundColor Cyan
    
    }
    catch {
        Write-Host "An error occurred: $_" -ForegroundColor Red
        Write-Host "Reconnecting to Compliance Center and retrying..." -ForegroundColor Yellow
        Connect-IPPSSession
    }
    
    
    

    Hope this helps. Do let us know if you any further queries.


    If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.


Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.