This example returns entries in the administrator audit log of an Exchange Online organization for cmdlets run by Microsoft datacenter administrators between September 17, 2013 and October 2, 2013.

Search-AdminAuditLog -ExternalAccess $true -StartDate 09/17/2013 -EndDate 10/02/2013 | Export-Csv -Path “c:\temp\admin.csv” -NoTypeInfomation

https://technet.microsoft.com/en-us/library/ff459250%28v=exchg.160%29.aspx?f=255&MSPPError=-2147217396