Microsoft Entra Suite Tech Accelerator
Aug 14 2024, 07:00 AM - 09:30 AM (PDT)
Microsoft Tech Community

Exchange not showing in query results

Copper Contributor

Hi guys.

So I'm using this query 

 

// Office activity for user 
// The query presents user's activity over Office. 
// Replace the UPN in the query with the UPN of the user of interest
let v_Users_UPN= "UserId";
OfficeActivity
| where UserId==v_Users_UPN 
| where TimeGenerated between (datetime(2023-05-24) ..1d)
| project OfficeWorkload, Operation, ResultStatus, OfficeObjectId, _ResourceId, TimeGenerated, Application
| summarize by OfficeWorkload, TimeGenerated
| summarize min(TimeGenerated), max(TimeGenerated) by OfficeWorkload
| extend FirstActivity = datetime_utc_to_local( min_TimeGenerated,'CET')
| extend LastActivity = datetime_utc_to_local(max_TimeGenerated,'CET') 
| project OfficeWorkload, FirstActivity, LastActivity, v_Users_UPN

 

 

And I can't figure out why I only get results for Teams, SP and OD but not Exchange? 

Does anyone have any idea why?

2 Replies
If I comment out line 6, in my data I see Exchange - perhaps you dont have any Exchange in that time period?

@Clive_Watson 

I tried that but that confuses me the most because at that time nobody works

mm83RI_0-1685020632682.png

and when I don't remove it, time of the activity is exact

 

mm83RI_1-1685020735898.png

Do you know what is the issue here?