May 25 2023 02:55 AM
Hi guys.
So I'm using this query
// Office activity for user
// The query presents user's activity over Office.
// Replace the UPN in the query with the UPN of the user of interest
let v_Users_UPN= "UserId";
OfficeActivity
| where UserId==v_Users_UPN
| where TimeGenerated between (datetime(2023-05-24) ..1d)
| project OfficeWorkload, Operation, ResultStatus, OfficeObjectId, _ResourceId, TimeGenerated, Application
| summarize by OfficeWorkload, TimeGenerated
| summarize min(TimeGenerated), max(TimeGenerated) by OfficeWorkload
| extend FirstActivity = datetime_utc_to_local( min_TimeGenerated,'CET')
| extend LastActivity = datetime_utc_to_local(max_TimeGenerated,'CET')
| project OfficeWorkload, FirstActivity, LastActivity, v_Users_UPN
And I can't figure out why I only get results for Teams, SP and OD but not Exchange?
Does anyone have any idea why?
May 25 2023 06:13 AM
May 25 2023 06:19 AM
I tried that but that confuses me the most because at that time nobody works
and when I don't remove it, time of the activity is exact
Do you know what is the issue here?