What’s the least painful way to pull guest sign-in logs?

For a one-off export, try Microsoft Graph PowerShell rather than repeatedly running the portal search. Connect with the audit-log read permission, query sign-in records with a guest-related filter if the service accepts it, and export the results. Check the returned records to confirm the filter is doing what you expect, since filter support and syntax can matter.

Keep the request small. A broad sign-in query can be slow, so narrow it by date range and, where supported, user type or another useful field. If throttling still happens, wait and retry with backoff instead of firing off several requests in quick succession.

If this is a recurring report, sending sign-in events to a Log Analytics workspace can make later searches and dashboards easier. That adds ingestion and retention costs, though, so it may be overkill for an occasional export.

Be cautious with a security hunting query that starts from an assumed guest field. The result can be misleading if the field is unavailable, named differently, or populated differently in that data source. First inspect a few records and verify how guest accounts are represented, then build the filter around the fields actually present.