Forum Discussion

Lazy_Extrovert's avatar
Lazy_Extrovert
Copper Contributor
Sep 23, 2022

Unable to query "Device" field in Activity Log

Hi TechCommunity,   I've got an issue where I am currently unable to run query's against the "Device" field in the Activity Log. To get the basics out of the way, I've added both our O365 & Azure ...
activity log
Query's
Raw Data
Keith_Fleming's avatar
Keith_Fleming
Icon for Microsoft rankMicrosoft
Sep 27, 2022

Hi Lazy_Extrovert,

 

Defender for Cloud Apps does pull the device status from sign in logs. I would expect to see compliant device status for successful or failed sign ins.

 

Some data you see in the activity logs is coming from other sources that might not contain this information though (SPO/OD activities for instance).

 

A search like this should show that information: 

 

 

Lazy_Extrovert's avatar
Lazy_Extrovert
Copper Contributor
Sep 29, 2022

Hi Keith_Fleming,

 

Thanks for the reply :smile:

 

That's exactly what I'm attempting to do. Looking into the raw data of the log on events from O365 I can see the "IsDeviceCompliantAndManaged: true" parameter, and yet, when I go to query log on events that are from devices that are managed/compliant, I get no results. 

 

I think I'll just hit up Microsoft with this and see what they think.

 

Cheers

Resources