Microsoft Entra Suite Tech Accelerator
Aug 14 2024, 07:00 AM - 09:30 AM (PDT)
Microsoft Tech Community

Exchange not showing in query results

Copper Contributor

Hi guys.

So I'm using this query 


// Office activity for user 
// The query presents user's activity over Office. 
// Replace the UPN in the query with the UPN of the user of interest
let v_Users_UPN= "UserId";
| where UserId==v_Users_UPN 
| where TimeGenerated between (datetime(2023-05-24) ..1d)
| project OfficeWorkload, Operation, ResultStatus, OfficeObjectId, _ResourceId, TimeGenerated, Application
| summarize by OfficeWorkload, TimeGenerated
| summarize min(TimeGenerated), max(TimeGenerated) by OfficeWorkload
| extend FirstActivity = datetime_utc_to_local( min_TimeGenerated,'CET')
| extend LastActivity = datetime_utc_to_local(max_TimeGenerated,'CET') 
| project OfficeWorkload, FirstActivity, LastActivity, v_Users_UPN



And I can't figure out why I only get results for Teams, SP and OD but not Exchange? 

Does anyone have any idea why?

2 Replies
If I comment out line 6, in my data I see Exchange - perhaps you dont have any Exchange in that time period?


I tried that but that confuses me the most because at that time nobody works


and when I don't remove it, time of the activity is exact



Do you know what is the issue here?