Missing Activity

[Dean_Gross]

My client ran reports on 37 users in defender for cloud apps for the past 90 days. 15 of them did not return any data which seems highly unlikely. These individuals were all employed during this timeframe. Can anyone provide any reasons for why we wouldn’t be seeing any cloud activity for these users?

[#2]

Hi Dean,

App connectors will pull data from a few different sources so if the data is present it should be displayed in the console. One reason why you might not see data for specific users is if the deployment has been scoped, this is used to include/exclude groups.

Would recommend checking here first. If you do not see the data and it's office apps your looking at also take a look at the unified audit logs to see if the activity is present there as well.

https://docs.microsoft.com/en-us/defender-cloud-apps/scoped-deployment