SOLVED

Azure Log Analytics Office 365 ProPlus Product Version Information

%3CLINGO-SUB%20id%3D%22lingo-sub-858944%22%20slang%3D%22en-US%22%3EAzure%20Log%20Analytics%20Office%20365%20ProPlus%20Product%20Version%20Information%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-858944%22%20slang%3D%22en-US%22%3E%3CP%3EHi.%20Requesting%20assistance%20to%20write%20a%20query%20for%20Azure%20Log%20Analytics%20(as%20part%20of%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fwindows%2Fdeployment%2Fupdate%2Fwindows-analytics-overview%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3EWindows%20Analytics%3C%2FA%3E%20for%20an%20environment)%20to%20determine%20details%20for%20Office%20365%20ProPlus%20versions%20in%20the%20environment.%20Initially%20looking%20to%20gather%20the%20computer%20name%20detailed%20Office%20365%20ProPlus%20version%20(for%20example%26nbsp%3BBuild%2011929.20300).%20Looking%20at%20the%20UAOfficeAddIn%20table%20but%20have%20yet%20to%20find%20details%20within%20it%20for%20build%20version%20data.%20Thank%20you.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-858944%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-860896%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20Log%20Analytics%20Office%20365%20ProPlus%20Product%20Version%20Information%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-860896%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F38912%22%20target%3D%22_blank%22%3E%40Adrian%20Wells%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAll%20of%20that%20data%20are%20in%20Tables%20that%20start%20with%20%22UA%22%2C%20so%20we%20can%20search%20in%20just%20those.%26nbsp%3B%20I%20needed%20to%20go%20back%20in%20the%20demo%20data%2C%20so%20used%2060days%2C%20you%20can%20change%20this%20for%20your%20data.%3C%2FP%3E%0A%3CDIV%3E%0A%3CDIV%3E%3CPRE%20class%3D%22lia-code-sample%20language-markup%22%3E%3CCODE%3Esearch%20in%20(UA*)%20%20%22Office%20365%20ProPlus%22%20%0A%7C%20where%20TimeGenerated%20%26gt%3B%20ago(60d)%0A%7C%20summarize%20count()%20by%20Type%20%3C%2FCODE%3E%3C%2FPRE%3E%3C%2FDIV%3E%0A%3C%2FDIV%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fms.portal.azure.com%23%4072f988bf-86f1-41af-91ab-2d7cd011db47%2Fblade%2FMicrosoft_Azure_Monitoring_Logs%2FDemoLogsBlade%2FresourceId%2F%252FDemo%2Fsource%2FLogsBlade.AnalyticsShareLinkToQuery%2Fq%2FH4sIAAAAAAAAAytOTSxKzlDIzFPQCHXU0lRQUPJPS8tMTlUwNjNVCCjKD8gpLVZS4OWqUSjPSC1KVQjJzE11T81LLUosSU1RsFNITM%25252FXMDNI0QSpKC7NzU0syqxKVUjOL80r0dBUSKpUCKksSFUAALyluyFmAAAA%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noreferrer%22%3EGo%20to%20Log%20Analytics%20and%20Run%20Query%3C%2FA%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FP%3E%0A%3CDIV%3E%0A%3CTABLE%20cellspacing%3D%221%22%20cellpadding%3D%225%22%3E%0A%3CTBODY%3E%0A%3CTR%3E%0A%3CTH%3EType%3C%2FTH%3E%0A%3CTH%3Ecount_%3C%2FTH%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3EUAProposedActionPlan%3C%2FTD%3E%0A%3CTD%3E468%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3EUAApp%3C%2FTD%3E%0A%3CTD%3E7001%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3C%2FTBODY%3E%0A%3C%2FTABLE%3E%0A%3C%2FDIV%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EFrom%20that%20result%2C%26nbsp%3B%3CSTRONG%3EUAApp%3C%2FSTRONG%3E%20Table%20looks%20promising%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-markup%22%3E%3CCODE%3EUAApp%0A%7C%20where%20TimeGenerated%20%26gt%3B%20ago(60d)%0A%7C%20where%20AppVendor%20%3D%3D%20%22Microsoft%20Corporation%22%0A%7C%20where%20AppName%20startswith%20%22Microsoft%20Office%20365%22%0A%7C%20summarize%20count()%20by%20Computer%2C%20AppVersion%20%2C%20AppName%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fms.portal.azure.com%23%4072f988bf-86f1-41af-91ab-2d7cd011db47%2Fblade%2FMicrosoft_Azure_Monitoring_Logs%2FDemoLogsBlade%2FresourceId%2F%252FDemo%2Fsource%2FLogsBlade.AnalyticsShareLinkToQuery%2Fq%2FH4sIAAAAAAAAA02NzQqCQBCA7z7F4EnBgxF5M5AOnapLdd90zAF3Z5kdkaKHbyMK79%25252FPpWm8T14wDygIZ7K4R4diFDvYgrlzVpVd%25252FgcifEXXsUBdQ3qgVjhwr7Bj8RwtYpcu4aOxCEGNaJhJh6Vy6ntqEdbV5mOEyVoj9ERoeXKa5XB7xKr1k6IU36%25252BEmIfi143WSJYUVmXyBvbOA57HAAAA%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noreferrer%22%3EGo%20to%20Log%20Analytics%20and%20Run%20Query%3C%2FA%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FP%3E%0A%3CDIV%3E%0A%3CTABLE%20cellspacing%3D%221%22%20cellpadding%3D%225%22%3E%0A%3CTBODY%3E%0A%3CTR%3E%0A%3CTH%3EComputer%3C%2FTH%3E%0A%3CTH%3EAppVersion%3C%2FTH%3E%0A%3CTH%3EAppName%3C%2FTH%3E%0A%3CTH%3Ecount_%3C%2FTH%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3ESavannaRh-Dsk.Contoso%3C%2FTD%3E%0A%3CTD%3E15.0.5163.1000%3C%2FTD%3E%0A%3CTD%3EMicrosoft%20Office%20365%20ProPlus%20-%20en-us%3C%2FTD%3E%0A%3CTD%3E24%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3ERobertHi-Corp.Contoso%3C%2FTD%3E%0A%3CTD%3E15.0.5153.1000%3C%2FTD%3E%0A%3CTD%3EMicrosoft%20Office%20365%20ProPlus%20-%20en-us%3C%2FTD%3E%0A%3CTD%3E34%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3ETerminal73.Contoso%3C%2FTD%3E%0A%3CTD%3E16.0.11901.20094%3C%2FTD%3E%0A%3CTD%3EMicrosoft%20Office%20365%20ProPlus%20-%20en-us%3C%2FTD%3E%0A%3CTD%3E38%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3EDebbieDi-Sales.Contoso%3C%2FTD%3E%0A%3CTD%3E16.0.11901.20176%3C%2FTD%3E%0A%3CTD%3EMicrosoft%20Office%20365%20ProPlus%20-%20en-us%3C%2FTD%3E%0A%3CTD%3E29%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3EBeverlySm-Dsktp.Contoso%3C%2FTD%3E%0A%3CTD%3E15.0.5127.1000%3C%2FTD%3E%0A%3CTD%3EMicrosoft%20Office%20365%20ProPlus%20-%20en-us%3C%2FTD%3E%0A%3CTD%3E38%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3EPeggyLe-Win.Contoso%3C%2FTD%3E%0A%3CTD%3E16.0.11328.20368%3C%2FTD%3E%0A%3CTD%3EMicrosoft%20Office%20365%20-%20en-us%3C%2FTD%3E%0A%3CTD%3E38%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3EKimberlyLe-Corp.Contoso%3C%2FTD%3E%0A%3CTD%3E16.0.11901.20176%3C%2FTD%3E%0A%3CTD%3EMicrosoft%20Office%20365%20ProPlus%20-%20en-us%3C%2FTD%3E%0A%3CTD%3E23%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3EJaime-Box.Contoso%3C%2FTD%3E%0A%3CTD%3E15.0.5127.1000%3C%2FTD%3E%0A%3CTD%3EMicrosoft%20Office%20365%20ProPlus%20-%20en-us%3C%2FTD%3E%0A%3CTD%3E34%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3ETuSharon-Work.Contoso%3C%2FTD%3E%0A%3CTD%3E16.0.11727.20244%3C%2FTD%3E%0A%3CTD%3EMicrosoft%20Office%20365%20ProPlus%20-%20en-us%3C%2FTD%3E%0A%3CTD%3E38%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3EMichaelSa-Dsktp.Contoso%3C%2FTD%3E%0A%3CTD%3E16.0.12013.20000%3C%2FTD%3E%0A%3CTD%3EMicrosoft%20Office%20365%20ProPlus%20-%20en-us%3C%2FTD%3E%0A%3CTD%3E10%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3C%2FTBODY%3E%0A%3C%2FTABLE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3Eor%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-markup%22%3E%3CCODE%3EUAApp%0A%7C%20where%20TimeGenerated%20%26gt%3B%20ago(30d)%0A%7C%20where%20AppVendor%20%3D%3D%20%22Microsoft%20Corporation%22%0A%7C%20where%20AppName%20startswith%20%22Microsoft%20Office%20365%20ProPlus%22%0A%7C%20summarize%20count(Computer)%20by%20AppVersion%20%0A%7C%20sort%20by%20count_Computer%20desc%20%0A%7C%20render%20barchart%20%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fms.portal.azure.com%23%4072f988bf-86f1-41af-91ab-2d7cd011db47%2Fblade%2FMicrosoft_Azure_Monitoring_Logs%2FDemoLogsBlade%2FresourceId%2F%252FDemo%2Fsource%2FLogsBlade.AnalyticsShareLinkToQuery%2Fq%2FH4sIAAAAAAAAA02OsQrCMBBAd7%25252Fi6NRuguhWoXRwUjuoq6TJ1QZMLlwSiuLHmyhKx7t7j3fnpnFu8YJpREY4aYM7tMgioIItiBuVq6Wq%25252FkCCL2gVMdQ1FHstmTwNAVpiR8nSZIs5fBAGwQfBwU86jHPlOAxaIqw2a%25252BiYunv02fTRGMH6iSAp2lC2ZFwMyBX0j2%25252BdfYpARolD3n7A6w8EhV7mM6c%25252F09gLlmPqwxsA5EFE6gAAAA%25253D%25253D%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3EGo%20to%20Log%20Analytics%20and%20Run%20Query%3C%2FA%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FP%3E%0A%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F132330i275462F0D7236633%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22clipboard_image_0.png%22%20title%3D%22clipboard_image_0.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-882981%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20Log%20Analytics%20Office%20365%20ProPlus%20Product%20Version%20Information%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-882981%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F239477%22%20target%3D%22_blank%22%3E%40Clive%20Watson%3C%2FA%3E%26nbsp%3BThank%20you%20for%20the%20example%20and%20explanation.%20This%20is%20helpful.%3C%2FP%3E%3C%2FLINGO-BODY%3E
New Contributor

Hi. Requesting assistance to write a query for Azure Log Analytics (as part of Windows Analytics for an environment) to determine details for Office 365 ProPlus versions in the environment. Initially looking to gather the computer name detailed Office 365 ProPlus version (for example Build 11929.20300). Looking at the UAOfficeAddIn table but have yet to find details within it for build version data. Thank you.

2 Replies
best response confirmed by Adrian Wells (New Contributor)
Solution

@Adrian Wells 

 

All of that data are in Tables that start with "UA", so we can search in just those.  I needed to go back in the demo data, so used 60days, you can change this for your data.

search in (UA*)  "Office 365 ProPlus" 
| where TimeGenerated > ago(60d)
| summarize count() by Type 

Go to Log Analytics and Run Query

Type count_
UAProposedActionPlan 468
UAApp 7001

 

From that result, UAApp Table looks promising:

 

 

UAApp
| where TimeGenerated > ago(60d)
| where AppVendor == "Microsoft Corporation"
| where AppName startswith "Microsoft Office 365"
| summarize count() by Computer, AppVersion , AppName

 

Go to Log Analytics and Run Query

Computer AppVersion AppName count_
SavannaRh-Dsk.Contoso 15.0.5163.1000 Microsoft Office 365 ProPlus - en-us 24
RobertHi-Corp.Contoso 15.0.5153.1000 Microsoft Office 365 ProPlus - en-us 34
Terminal73.Contoso 16.0.11901.20094 Microsoft Office 365 ProPlus - en-us 38
DebbieDi-Sales.Contoso 16.0.11901.20176 Microsoft Office 365 ProPlus - en-us 29
BeverlySm-Dsktp.Contoso 15.0.5127.1000 Microsoft Office 365 ProPlus - en-us 38
PeggyLe-Win.Contoso 16.0.11328.20368 Microsoft Office 365 - en-us 38
KimberlyLe-Corp.Contoso 16.0.11901.20176 Microsoft Office 365 ProPlus - en-us 23
Jaime-Box.Contoso 15.0.5127.1000 Microsoft Office 365 ProPlus - en-us 34
TuSharon-Work.Contoso 16.0.11727.20244 Microsoft Office 365 ProPlus - en-us 38
MichaelSa-Dsktp.Contoso 16.0.12013.20000 Microsoft Office 365 ProPlus - en-us 10

 

 

or

 

UAApp
| where TimeGenerated > ago(30d)
| where AppVendor == "Microsoft Corporation"
| where AppName startswith "Microsoft Office 365 ProPlus"
| summarize count(Computer) by AppVersion 
| sort by count_Computer desc 
| render barchart 

 

Go to Log Analytics and Run Query

clipboard_image_0.png

@Clive Watson Thank you for the example and explanation. This is helpful.