We’re thrilled to share that the new CloudAppEvents table is now available as a public preview in advanced hunting for Microsoft 365 Defender.
This new advanced hunting schema table contains ac...
Updated Nov 19, 2020
Version 2.0
Blog Post
king-02 Are you in GCC cloud, GCC high, or Commercial Cloud? There is usually a long delay between when tables are available in the commercial cloud vs. government clouds. I've been sitting here tonight analyzing which tables are available in which clouds because I often come across queries that don't work and have to come up with workarounds. For example, I operate in GCC and I don't have the tables for CloudAppEvents, despite using the requisite features in our tenant. I do have CloudAppEvents, but I didn't always have it. I'm going to check with my Microsoft representatives or open a support ticket to find out more. However, if it's unreleased they generally won't provide a release date.
Also do you have preview features enabled in Settings of MDE? Settings > Endpoints > Advanced features > Preview features.
This hasn't helped resolve it for me, but it might help you depending on your tenant.