Enhanced reporting
1 vote
Hello,
So we just recently started looking into reporting, trying to get data into Power BI. However, it turned to be a challenge. The PS command Export-DSPamAccountAccessReport did only dump the permissions on each PAM account, so we turned to the GUI with Reports - Scheduled reports. The content is what we are looking for, however, the only way of getting the data out is by e-mailing a file to mailbox.
We would like to request either more of the GUI report content being available using PowerShell and/or if it's in the stars to add support for file share or Azure blob, for storing the Scheduled reports .
Regards,
Simon
All Comments (4)
Hello Simon,
This can be added to the PowerShell module. To better understand the scope of your request, could you let us know which reports are most essential to your use case? That will help us prioritize the implementation more effectively.
Best regards,
Maxime
Hello Simon,
This can be added to the PowerShell module. To better understand the scope of your request, could you let us know which reports are most essential to your use case? That will help us prioritize the implementation more effectively.
Best regards,
Maxime
@Maxime Bernier
Hello,
I would say basics; password rotation, recent PAM activities like check out/in, view password. We would also like a report that covered PAM accounts imported to vaults, as well as PAM vaults being created.
Regards,
Simon
Hello,
Thank you for the additional details — that precision is very helpful. We’ve noted your requirements and added them to our backlog for evaluation and implementation.
We’ll keep you informed as soon as we have updates on these enhancements.
Best regards,
Maxime
Hi Simon,
Sorry for the delay. The module version 2026.1.5 ships four new reporting cmdlets that address the use cases you described.
- Get-DSPamLog is the PowerShell equivalent of the PAM Recent Activities report. It covers checkouts, check-ins, password views, account imports, and policy changes. Filterable by event type, date range, credential, vault, or user. Note that PAM system events are excluded by default — pass -IncludePamSystem to include them.
- Get-DSPamPasswordRotationLog mirrors the Last Password Update report. It returns the last rotation record per account, including credential type, vault, folder, timestamp, and schedule. Accounts that have never been rotated are excluded unless you pass -IncludeNoPasswordUpdate.
- Get-DSActivityLog is the equivalent of Activity Logs. It covers connection events across all vaults — use -MessageType to narrow down to PAM-specific events.
- Get-DSAdministrationLog maps to Administration Logs. It captures server-level events, including PAM vault creation and configuration changes. There is currently no filter to isolate PAM events from other administrative events, so some post-processing on the results will be needed.
If anything is missing or needs improvement, let us know!
Best regards,
Maxime