Advanced Hunting - Unable to search 'EmailEvents'

[DG0071635]

Hello,

I have a customer that is getting the error below and would like some insight on it?

Issue:

When using the Advanced Hunting, the object 'EmailEvents' returns:
"Syntax error
Error message
The incomplete fragment is unexpected"

[#2]

Hi @DG0071635 ,

could you please provide us the query that is throwing this error?

Redacting any PII ofc.

Also some quick possible solutions, are they licensed for Defender for Office 365? Do you see data in the Email & Collaboration Explorer in XDR portal?

Are they set with the proper access via Defender XDR RBAC ?

Thank you,

Dylan

[#3]

The customer said they had recently shifted from a P2 license to a P1 and this more than likely caused the loss of ability to search. So this will be resolved by making adjustments to the license.