How to retrieve only authorization.action via PS - azure

Question

Trying to retrieve the value of Authorization.action from Get-AzActivityLog | select-Object but I am having difficulty filtering my results down to what I need.
When running the below, I get results but when I pipe to Select-Object to only return the specified values, I get values for all except Autorization.action. Fairly new so not sure how to accomplish this and not finding documentation that clarifies to me online. Obviously Authorization.action is not correct but I can't seem to find a solution.
Get-AzActivityLog -ResourceId $sa.Id `
-StartTime ((Get-Date).AddDays($timeframe)) `
-Status Succeeded `
| where {$_.Authorization.action -like "Microsoft.Storage/storageAccounts/regenerateKey/action"} `
| Select-Object Authorization.action, EventTimestamp, ResourceGroupName, ResourceId
Output
Thanks for any insight in to this.

Answer 1

You could do it in Multiple ways :
Get-AzActivityLog -ResourceId $sa.Id `
-StartTime ((Get-Date).AddDays($timeframe)) `
-Status Succeeded `
| where {$_.Authorization.action -like "Microsoft.Storage/storageAccounts/regenerateKey/action"} `
| Select-Object {$_.Authorization.action}, EventTimestamp, ResourceGroupName, ResourceId
Or
Like Mathias Mentioned :
Get-AzActivityLog -ResourceId $sa.Id `
-StartTime ((Get-Date).AddDays($timeframe)) `
-Status Succeeded `
| where {$_.Authorization.action -like "Microsoft.Storage/storageAccounts/regenerateKey/action"} `
| Select-Object #{Name='AuthorizationAction';Expression={$_.Authorization.action}}, EventTimestamp, ResourceGroupName, ResourceId
The Reason Being Select-Object chooses the immediate property of the object. However, in your case the Authorization.Action is one level down being a complex property. So you will have to evaluate the expression.
Also you could use the -ExpandProperty parameter to expand a complex property.
Select-Object Authorization -ExpandProperty Authorization | Select-Object Action