It seems a string formatting error since it's missing the } that close the object

Following the script that I use:

$ClientSecretCredential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $AppID, (ConvertTo-SecureString -String $AppSecret -AsPlainText -Force)
Connect-MgGraph -ClientSecretCredential $ClientSecretCredential -TenantId $TID -ErrorAction Stop

New-MgBetaSecurityAuditLogQuery -FilterStartDateTime "2024-03-25 00:00" -FilterEndDateTime "2024-03-29 23:59" -DisplayName "activities"

PS C:\Users\Skype4bsched> Get-MgBetaSecurityAuditLogQueryRecord -AuditLogQueryId QueryID -All -Debug
DEBUG: [CmdletBeginProcessing]: - Get-MgBetaSecurityAuditLogQueryRecord begin processing with parameterSet 'List'.
DEBUG: [Authentication]: - AuthType: 'AppOnly', TokenCredentialType: 'ClientSecret', ContextScope: 'Process', AppName: 'GOSP-UCC-Reporting'.
DEBUG: [Authentication]: - Scopes: [...AuditLogsQuery.Read.All, AuditLog.Read.All, ...].
DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
GET

Absolute Uri:
https://graph.microsoft.com/beta/security/auditLog/queries/*QueryID*/records

Headers:
FeatureFlag : 00000043
Cache-Control : no-store, no-cache
User-Agent : Mozilla/5.0,(Windows NT 10.0; Microsoft Windows 10.0.17763; it-IT),PowerShell/5.1.17763.5696
Accept-Encoding : gzip
SdkVersion : graph-powershell-beta/2.17.0
client-request-id : ClientID

Body:

DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
OK

Headers:
Transfer-Encoding : chunked
Vary : Accept-Encoding
Strict-Transport-Security : max-age=31536000
request-id : 49dd6246-10aa-4a4f-ba47-e2820c958696
client-request-id : ClientID
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"Italy North","Slice":"E","Ring":"3","ScaleUnit":"001","RoleInstance":"MI2PEPF000002CD"}}
OData-Version : 4.0
Cache-Control : no-cache
Date : Fri, 12 Apr 2024 08:34:30 GMT

Body:
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#security/auditLog/queries('*QueryID*')/records",
"@odata.count": 150,
"@odata.nextLink": "https://graph.microsoft.com/beta/security/auditLog/queries/*QueryID*/records?$skiptoken=1!4!MA--%2f1!48!MDAwOGE5ZTQtYTgzOC00NjcxLTI3OTgtMDhkYzRkOGNiYTY1",
"value": [...]
}

DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
GET

Absolute Uri:
https://graph.microsoft.com/beta/security/auditLog/queries/*QueryID*/records?$skiptoken=1!4!MA--%2f1!48!MDAwOGE5ZTQtYTgzOC00NjcxLTI3OTgtMDhkYzRkOGNiYTY1

Headers:
FeatureFlag : 00000043
Cache-Control : no-store, no-cache
Accept-Encoding : gzip
SdkVersion : graph-powershell-beta/2.17.0,
client-request-id : 25806d5f-7bdd-4a3d-ac0b-c0496b2cd5e5
User-Agent : Mozilla/5.0,(Windows NT 10.0; Microsoft Windows 10.0.17763; it-IT),PowerShell/5.1.17763.5696

Body:

DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
OK

Headers:
Transfer-Encoding : chunked
Vary : Accept-Encoding
Strict-Transport-Security : max-age=31536000
request-id : 95a34a58-4332-493c-820d-0692c61ce6b6
client-request-id : 25806d5f-7bdd-4a3d-ac0b-c0496b2cd5e5
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"Italy North","Slice":"E","Ring":"3","ScaleUnit":"001","RoleInstance":"MI2PEPF000002CD"}}
OData-Version : 4.0
Cache-Control : no-cache
Date : Fri, 12 Apr 2024 08:34:32 GMT

Body:
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#security/auditLog/queries('*QueryID*')/records",
"@odata.count": 150,
"@odata.nextLink": "https://graph.microsoft.com/beta/security/auditLog/queries/*QueryID*/records?$skiptoken=1!4!MA--%2f1!48!MDAxMGYwNDAtYmM5Mi00YzZmLTZlZTYtMDhkYzRjYTE3ODA2",
"value": [...]
}

Id AdministrativeUnits AuditLogRecordType ClientIP CreatedDateTime ObjectId

---

DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
GET

Absolute Uri:
https://graph.microsoft.com/beta/security/auditLog/queries/*QueryID*/records?$skiptoken=1!4!MA--%2f1!48!MDAxMGYwNDAtYmM5Mi00YzZmLTZlZTYtMDhkYzRjYTE3ODA2

Headers:
FeatureFlag : 00000043
Cache-Control : no-store, no-cache
Accept-Encoding : gzip
SdkVersion : graph-powershell-beta/2.17.0,
client-request-id : 0ed353da-584c-4760-b8be-d5aa082b1c47
User-Agent : Mozilla/5.0,(Windows NT 10.0; Microsoft Windows 10.0.17763; it-IT),PowerShell/5.1.17763.5696

Body:

DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
OK

Headers:
Transfer-Encoding : chunked
Vary : Accept-Encoding
Strict-Transport-Security : max-age=31536000
request-id : edb7916f-f77e-451b-b610-bf02b4851563
client-request-id : 0ed353da-584c-4760-b8be-d5aa082b1c47
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"Italy North","Slice":"E","Ring":"3","ScaleUnit":"001","RoleInstance":"MI2PEPF000002CD"}}
OData-Version : 4.0
Cache-Control : no-cache
Date : Fri, 12 Apr 2024 08:34:34 GMT

Body:
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#security/auditLog/queries('*QueryID*')/records",
"@odata.count": 150,
"@odata.nextLink": "https://graph.microsoft.com/beta/security/auditLog/queries/*QueryID*/records?$skiptoken=1!4!MA--%2f1!48!MDAxOTcwNzEtMWMxYy00NWNkLWQzZjktMDhkYzRlMzkyMGRi",
"value": [...]
}

DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
GET

Absolute Uri:
https://graph.microsoft.com/beta/security/auditLog/queries/*QueryID*/records?$skiptoken=1!4!MA--%2f1!48!MDAxOTcwNzEtMWMxYy00NWNkLWQzZjktMDhkYzRlMzkyMGRi

Headers:
FeatureFlag : 00000043
Cache-Control : no-store, no-cache
Accept-Encoding : gzip
SdkVersion : graph-powershell-beta/2.17.0,
client-request-id : 5e3b79cc-e9de-4de9-8676-0f7ddca8f5e2
User-Agent : Mozilla/5.0,(Windows NT 10.0; Microsoft Windows 10.0.17763; it-IT),PowerShell/5.1.17763.5696

Body:

DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
OK

Headers:
Transfer-Encoding : chunked
Vary : Accept-Encoding
Strict-Transport-Security : max-age=31536000
request-id : 8ba8f3e4-9459-4777-b506-5d1152fceeca
client-request-id : 5e3b79cc-e9de-4de9-8676-0f7ddca8f5e2
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"Italy North","Slice":"E","Ring":"3","ScaleUnit":"001","RoleInstance":"MI2PEPF000002CD"}}
OData-Version : 4.0
Cache-Control : no-cache
Date : Fri, 12 Apr 2024 08:34:35 GMT

Body:
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#security/auditLog/queries('*QueryID*')/records",
"@odata.count": 150,
"@odata.nextLink": "https://graph.microsoft.com/beta/security/auditLog/queries/*QueryID*/records?$skiptoken=1!4!MA--%2f1!48!MDAyMWRkNzgtN2ZiYi00ZWI2LWYxZTYtMDhkYzRlNTBiZjVh",
"value": [...]
}

DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
GET

Absolute Uri:
https://graph.microsoft.com/beta/security/auditLog/queries/*QueryID*/records?$skiptoken=1!4!MA--%2f1!48!MDAyMWRkNzgtN2ZiYi00ZWI2LWYxZTYtMDhkYzRlNTBiZjVh

Headers:
FeatureFlag : 00000043
Cache-Control : no-store, no-cache
Accept-Encoding : gzip
SdkVersion : graph-powershell-beta/2.17.0,
client-request-id : 917fecde-2343-4130-add3-db179e2392fd
User-Agent : Mozilla/5.0,(Windows NT 10.0; Microsoft Windows 10.0.17763; it-IT),PowerShell/5.1.17763.5696

Body:

DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
OK

Headers:
Transfer-Encoding : chunked
Vary : Accept-Encoding
Strict-Transport-Security : max-age=31536000
request-id : a91c3698-df25-4b46-a0e9-2e3aa996b628
client-request-id : 917fecde-2343-4130-add3-db179e2392fd
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"Italy North","Slice":"E","Ring":"3","ScaleUnit":"001","RoleInstance":"MI2PEPF000002CD"}}
OData-Version : 4.0
Cache-Control : no-cache
Date : Fri, 12 Apr 2024 08:34:37 GMT

Body:
{...,
{"id":"002aae90-f402-c84e-6212-2a14a29e4f36",
"createdDateTime":"2024-03-27T13:04:31Z",
"auditLogRecordType":"Yammer",
"operation":"FileVisited",
"organizationId":"",
"userType":"Regular",
"userId":"",
"service":"Yammer",
"objectId":".jpg",
"userPrincipalName":"",
"clientIp":null,
"administrativeUnits":[""]
{"error":
{"code":"UnknownError",
"message":"Unexpected Jsontoken. Check response for property value[141].auditData.ActorYammerUserId",
"innerError":{"date":"2024-04-12T08:44:40",
"request-id":"e6e1bd2f-3476-453d-903f-945dda906c28",
"client-request-id":"3d8b7b60-2d19-416e-9e0e-0d973fea9101"
}
}
}

}

DEBUG: [CmdletException]: Received exception with message 'ParserException - Expected String while reading Expected field name). Was LeftBrace: {. : at Microsoft.Graph.Beta.PowerShell.Runtime.Json.TokenReader.Ensure(TokenKind kind, String readerName)
at Microsoft.Graph.Beta.PowerShell.Runtime.Json.JsonParser.ReadObject()
at Microsoft.Graph.Beta.PowerShell.Runtime.Json.JsonParser.ReadArray()
at Microsoft.Graph.Beta.PowerShell.Runtime.Json.JsonParser.ReadFieldValue()
at Microsoft.Graph.Beta.PowerShell.Runtime.Json.JsonParser.ReadField()
at Microsoft.Graph.Beta.PowerShell.Runtime.Json.JsonParser.ReadObject()
at Microsoft.Graph.Beta.PowerShell.Runtime.Json.JsonParser.ReadNode()
at Microsoft.Graph.Beta.PowerShell.Runtime.Json.JsonNode.Parse(SourceReader sourceReader)
at Microsoft.Graph.Beta.PowerShell.Security.<>c.<SecurityAuditLogQueryListRecord_Call>b__375_0(Task1 body) at System.Threading.Tasks.ContinuationResultTaskFromResultTask2.InnerInvoke()
at System.Threading.Tasks.Task.Execute()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Graph.Beta.PowerShell.Cmdlets.GetMgBetaSecurityAuditLogQueryRecord_List.d__94.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Graph.Beta.PowerShell.Security.<SecurityAuditLogQueryListRecord_Call>d__375.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at Microsoft.Graph.Beta.PowerShell.Security.<SecurityAuditLogQueryListRecord_Call>d__375.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at Microsoft.Graph.Beta.PowerShell.Cmdlets.GetMgBetaSecurityAuditLogQueryRecord_List.d__94.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Graph.Beta.PowerShell.Security.<SecurityAuditLogQueryListRecord_Call>d__375.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at Microsoft.Graph.Beta.PowerShell.Security.<SecurityAuditLogQueryListRecord_Call>d__375.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Graph.Beta.PowerShell.Security.d__373.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Graph.Beta.PowerShell.Cmdlets.GetMgBetaSecurityAuditLogQueryRecord_List.d__92.MoveNext()'
Get-MgBetaSecurityAuditLogQueryRecord : Expected String while reading Expected field name). Was LeftBrace: {.
At line:1 char:1

• Get-MgBetaSecurityAuditLogQueryRecord -AuditLogQueryId ****- ...

•   + CategoryInfo          : NotSpecified: (:) [Get-MgBetaSecur...ueryRecord_List], ParserException
    + FullyQualifiedErrorId : Microsoft.Graph.Beta.PowerShell.Cmdlets.GetMgBetaSecurityAuditLogQueryRecord_List
  
  

DEBUG: [CmdletEndProcessing]: - Get-MgBetaSecurityAuditLogQueryRecord end processing.

Module Version
Get-Module Microsoft.Graph*

ModuleType Version Name ExportedCommands

---

Script 2.17.0 Microsoft.Graph.Authentication {Add-MgEnvironment, Connect-MgGraph, Disconnect-MgGraph, Get-MgContext...}
Script 2.17.0 Microsoft.Graph.Beta.Security {Add-MgBetaSecurityCaseEdiscoveryCaseCustodianHold, Add-MgBetaSecurityCaseEdiscoveryCaseNoncustodialDataSourceHold, Add-MgBetaSecurityCaseEdiscoveryCaseReviewSetQueryTag, Add-MgBetaSecurityCaseEdi...
Script 2.17.0 Microsoft.Graph.Users {Get-MgUser, Get-MgUserCount, Get-MgUserCreatedObject, Get-MgUserCreatedObjectAsServicePrincipal...}

Environment Data
$PSVersionTable

Name Value

---

PSVersion 5.1.17763.5696
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.17763.5696
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1