File activity

[Alex Verboon]

Hello,

I read about the January change regarding file monitoring on SharePoint. I use a demo tenant and have enabled the file activity setting, nevertheless I don’t see any file activity from Users.

Did I overlook something?

Thanks
Alex

[#2]

I’m referring to this change
https://docs.microsoft.com/en-us/cloud-app-security/release-notes#cloud-app-security-release-139-140

[#3]

@Sebastien Molendijk is this something you can speak to?

[#4]

Hi,

The setting we are talking about in the release note is about files monitoring (files scanning/discovery).

If you want to monitor users activities related to files, like modification, download, sharing, …, you have to enable Office 365 auditing in the Security and Compliance Center, which is not enabled by default.

[#5]

Hello @Sebastien Molendijk , 

Thanks for your reply. I now tested this in 3 tenants. 1st Tenant is our company production tenant once I upload a file to sharepoint within minutes I see the file appear in Cloud App Security under Investigate Files.  We have Office 365 audit logging enabled. This is the behavior I've seen working since ever. 

However on two tenants that I provisioned via demos.microsoft.com just recently this doesn't seem to work anymore. Yes Office 365 auditing is enabled, I can even see the activities within minutes in the Security and Compliance / Audit log search portal. But for some reason they are not showing up in Cloud App Security under Investigate Files. 

I read something about potential delays here: https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api...

But how likely is it that i am facing the same issue in two separate tenants? Anything else where i could look , i might have overlooked? 

Appreciate any hnts, since i plan to use thse demo tenants for upcomming demo's , this always just worked, but now doesn't :) and i don't want to use our production tenant. 

[#6]

Hi,

There is lower priority to demos tenants, that's probably why you have different results between environments.

If you want to show immediate results for files scanning in demos, I would recommend to create a free Box dev account and connect it to your MCAS environment.

Br

[#7]

Thanks , will give that a try, however to really demonstrate the capabilities with SharePoint, OneDrive it would be great if demos would have the same priority, after all first intend is to move users to Office 365 and not to Box :) per se.  Right now it appears to either never show up or probably after days. I assume this "lower priority" was introduced recently? because previously during the past 6 months i could always use this in customer / conference demos. 

Alex

[#8]

Thanks , will give that a try, however to really demonstrate the capabilities with SharePoint, OneDrive it would be great if demos would have the same priority, after all first intend is to move users to Office 365 and not to Box :) per se. Right now it appears to either never show up or probably after days. I assume this "lower priority" was introduced recently? because previously during the past 6 months i could always use this in customer / conference demos.

[#9]

Hi,

As we have thousands of demo tenants, we want to avoid any possible performance impact on production tenants and datacenters capacity, reason why they don't have the same priority.

What I would suggest is to create another tenant in another region to check the behavior.

Br

[#10]

Hi @Alex Verboon ,

I'd like to check this further to make sure everything is working as expected. Could you send me your email in a direct message? Or email me at didonhin@microsoft.com

Regards,

Dima.

[#11]

Hello Dima, 

just send you an email