AIP LogAnalytics not containing Outlook Events with latest UL Client

%3CLINGO-SUB%20id%3D%22lingo-sub-2294539%22%20slang%3D%22en-US%22%3EAIP%20LogAnalytics%20not%20containing%20Outlook%20Events%20with%20latest%20UL%20Client%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2294539%22%20slang%3D%22en-US%22%3E%3CP%3EHi%3C%2FP%3E%3CP%3EWe%20do%20have%20a%20serious%20issue%20with%20AIP%20LogAnalytics%20data.%20Office-Outlook%20does%20not%20send%20AIP%20telemetry%20to%20AIP%20LogAnalytics%20workspace.%20Metrics%20we%20look%20at%20is%20the%20count%20of%20new%20assigned%20labels%20by%20application%20and%20by%20label%20assigned.%20This%20gives%20us%20approximately%20an%20idea%20of%20how%20our%20users%20apply%20labels.%20The%20distribution%20of%20labels%20assigned%20is%20an%20indicator%20of%20whether%20we%20have%20to%20plan%20an%20awareness%20campaign%20or%20just%20observe%20further.%20We%20observe%20the%20flow%20about%20every%20month%20retrospective%2031d.%20During%20the%20past%20year%20this%20gave%20us%20a%20pretty%20smooth%20idea%20what's%20going%20on.%20We%20simply%20use%20a%20LogAnalytics%20Query%20to%20sum%20up%20the%20values%20required%2C%20so%20no%20magic.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EBy%20end%20of%20February%20we%20shipped%20the%20latest%20UL%20Client.%20Hurray%2C%26nbsp%3B%20one%20month%20later%20the%20outlook%20label%20count%20over%20all%20labels%20is%20not%20close%20to%20where%20it%20should%20be.%20Our%20observation%20showed%20that%20some%20clients%20still%20send%20telemetry%20data.%20However%20most%2C%20say%2098%25%20of%20Outlook%20Clients%20do%20not!%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERemove%20client%2C%20native%20office%20outlook%20experience%20does%20not%20send%20telemetry%20data%20as%20well.%20Install%20the%20older%20version%20of%20the%20client%20fixes%20the%20issue.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERegarding%20native%2C%20web%20and%20mobile%20clients%20will%20become%20an%20issue%20soon.%20We%20are%20rolling%20out%20MS%20Teams%26nbsp%3B%20including%20web%20and%20mobile%20access.%20Those%20label%20usage%20telemetry%20data%20is%20even%20important%20to%20us.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhat%20is%20though%20interesting%20is%20that%20I%20can%20see%20an%20approx.%20valid%20count%20in%20compliance%20center%20--%26gt%3B%20activity%20explorer%2C%20filtered%20by%20outlook%20-%20here%20I%20see%20expected%20figures%20while%20in%20the%20Azure%20Portal-%26gt%3BLogAnalytics--%26gt%3BQuery%20I%20cannot%20get%20close%20this%20figures%20using%20similar%20parameters.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ENow%20-%20what%20is%20the%20recommended%20approach%20generating%20such%20simple%20stats%20a)%20with%20the%20UL%20Client%20and%20b)%20cross%20platform%3F%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EOr%20is%20there%20an%20issue%20we%20should%20be%20aware%20of%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAny%20hint%20is%20highly%20appreciated.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EKind%20regards%3C%2FP%3E%3CP%3EMax%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2317857%22%20slang%3D%22en-US%22%3ERe%3A%20AIP%20LogAnalytics%20not%20containing%20Outlook%20Events%20with%20latest%20UL%20Client%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2317857%22%20slang%3D%22en-US%22%3EWell%2C%20well%20-%20further%20observation%20showed%20that%20the%20latest%20versions%20of%20UL%20Client%20of%20Outlook%20does%20send%20all%20AIP%20Events%20(except%20those%20grabbing%20attachments)%20as%20%22Access%22.%3CBR%20%2F%3EAs%20mentioned%20in%20the%20request%20above%2C%20an%20earlier%20version%20does%20not%20show%20this%20behaving.%20The%20only%20solution%20at%20this%20point%20is%20a%20fall-back.%20Ticket%20opened.%3CBR%20%2F%3EAnother%20one%3A%20Excel%20open%20a%20csv%20file%20(*.txt)%20--%26gt%3B%20save%20as%20xlsx%20--%26gt%3B%20no%20label%20enforced%20even%20configured%20properly.%3CBR%20%2F%3E%3CBR%20%2F%3EWill%20come%20back%20as%20soon%20as%20the%20issue%20is%20resolved%20in%20a%20next%20version%20of%20the%20UL%20client.%3CBR%20%2F%3E%3CBR%20%2F%3ERegards%20Max%3CBR%20%2F%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

Hi

We do have a serious issue with AIP LogAnalytics data. Office-Outlook does not send AIP telemetry to AIP LogAnalytics workspace. Metrics we look at is the count of new assigned labels by application and by label assigned. This gives us approximately an idea of how our users apply labels. The distribution of labels assigned is an indicator of whether we have to plan an awareness campaign or just observe further. We observe the flow about every month retrospective 31d. During the past year this gave us a pretty smooth idea what's going on. We simply use a LogAnalytics Query to sum up the values required, so no magic.

 

By end of February we shipped the latest UL Client. Hurray,  one month later the outlook label count over all labels is not close to where it should be. Our observation showed that some clients still send telemetry data. However most, say 98% of Outlook Clients do not! 

 

Remove client, native office outlook experience does not send telemetry data as well. Install the older version of the client fixes the issue.

 

Regarding native, web and mobile clients will become an issue soon. We are rolling out MS Teams  including web and mobile access. Those label usage telemetry data is even important to us.

 

What is though interesting is that I can see an approx. valid count in compliance center --> activity explorer, filtered by outlook - here I see expected figures while in the Azure Portal->LogAnalytics-->Query I cannot get close this figures using similar parameters.

 

Now - what is the recommended approach generating such simple stats a) with the UL Client and b) cross platform? 

 

Or is there an issue we should be aware of?

 

Any hint is highly appreciated.

 

Kind regards

Max

 

1 Reply
Well, well - further observation showed that the latest versions of UL Client of Outlook does send all AIP Events (except those grabbing attachments) as "Access".
As mentioned in the request above, an earlier version does not show this behaving. The only solution at this point is a fall-back. Ticket opened.
Another one: Excel open a csv file (*.txt) --> save as xlsx --> no label enforced even configured properly.

Will come back as soon as the issue is resolved in a next version of the UL client.

Regards Max