A Teams' SharePoint online file activity not logged in MCAS

[Steven Sanders]

We have file activity enabled in MCAS.  I can filter the activity by SharePoint online and see activity.  The file activity, however, for a SharePoint online site connected to a Microsoft Teams is not being captured in MCAS.  Changing the app filter to just Microsoft Teams returns no results.

Are we missing a configuration setting or is this a defect?

[#2]

Hi@Steven Sanders 

Teams sites activities are also logged under Sharepoint Online and not under Microsoft Teams, so you would need to filter on SPO to see them. The teams site will be represented as any other SPO site in MCAS.

Regards,

Dima

[#3]

@Dima Donhin I understand that and there in lies the problem.  The Teams' SharePoint file activity is not being log.  When I filter the app to only SPO, recent file activity for a Teams SPO is not listed.

[#4]

Can you please create a support request through the MCAS portal and send me the number in a private message? I'll make sure it gets investigated.

[#5]

Any update on this issue? I have a similar problem in a recent demo tenant started via demos.microsoft.com. All file related activity on Sharepoint sites that get created via Teams does not show up in MCAS. I ultimately want to create a file policy that auto-labels Teams folder content with a specific label from AIP. But the folder does not resolve in MCAS.

[#6]

Hi Emanuel,
There is a limitation on demo tenants due to which Teams sites arent visible. This affects inly tenants created via the demos portal, not trial / production tenants.
We're working on removing this limitation.

Regards,
Dima

[#7]

@Dima Donhin sorry to resurrect an old thread. Is this still an issue on demo tenants?

I’ve been testing in a demo tenant and noting that the OD4B paths can be chosen in a Files policy but SPO or Teams SPO sites remain empty even when adding data to active sites trying to get it to populate.

Funny enough, you can audit SPO in MCAS and verify it is working as expected but the SPO sites just cannot be found under files or applied to policies. 

[#8]

Is there a time line to be able to Teams SharePoint sites will be visible in Defender for Cloud Apps in a demo tenant