Forum Discussion
Missing Activity
My client ran reports on 37 users in defender for cloud apps for the past 90 days. 15 of them did not return any data which seems highly unlikely. These individuals were all employed during this time...
Keith_Fleming
Microsoft
MicrosoftHi Dean,
App connectors will pull data from a few different sources so if the data is present it should be displayed in the console. One reason why you might not see data for specific users is if the deployment has been scoped, this is used to include/exclude groups.
Would recommend checking here first. If you do not see the data and it's office apps your looking at also take a look at the unified audit logs to see if the activity is present there as well.
https://docs.microsoft.com/en-us/defender-cloud-apps/scoped-deployment
App connectors will pull data from a few different sources so if the data is present it should be displayed in the console. One reason why you might not see data for specific users is if the deployment has been scoped, this is used to include/exclude groups.
Would recommend checking here first. If you do not see the data and it's office apps your looking at also take a look at the unified audit logs to see if the activity is present there as well.
https://docs.microsoft.com/en-us/defender-cloud-apps/scoped-deployment