Forum Discussion

jokej_outlook's avatar
jokej_outlook
Copper Contributor
Sep 28, 2022

Export MDCA policy matches information via web console or API

Hi Everyone, 

This is my maiden post and thought this community to be able to give me guidance and help on my situation.

 

I have created a policy to detect file violations using defender for cloud apps (previously MCAS), and the total count has reached approx. 1.2 million for specific Azure Info Protection (AIP) labels that matches the files stored on OneDrive and SharePoint Online. 

 

I'd like to export the records in an efficient manner, and I've explored:

1) via website, which limits to 5,000 records onto csv file

2) via Graph API which limits to 100 records every 2-seconds based on API calls limit imposed system wide

 

Both are not working out, as (1) I can't live with 5,000 records, and the work around would be to implement an RPA via say PowerAutomate desktop or UI Path to do some form of web-scraping to download records and changing the advanced filters to a modified date range... even then, I am not quite sure how to do this yet, and if someone out there knows it, do let me know so that I can attempt to figure out via self-learning.

 

Option (2) which is the method I've attempted, is futile as the process is inconsistent and I am continuously facing errors every time I execute scripts to download the records and export them onto the csv file. 

 

I'd like to know if anyone in the community has a better way/approach for me to deal with this situation.

 

I tried to segregate my policy by the year of detection (2020, 2021 and 2022), and I am seeing 500k records for 2022, and 300k records for 2021, likely another 400k records for 2020 and before.

 

I am quite stuck at the moment and would appreciate if anyone have any ideas on how to deal with exporting the information captured in the policy which I've created to detect file violations on the tenant.

 

Caroline_Lee GershonLevitz-MSFT for visibility and recommendations.. 🙂

2 Replies

    • jokej_outlook's avatar
      jokej_outlook
      Copper Contributor

      ApoorvaKasbekarwe are also still waiting for MSOFT to release an enhancement to the export capabilities to csv file. Its akin to report processing for list of teams, list of users from the admin console.

       

      last i heard it should be avail for preview sometime q2-cy23...

Resources