Chapter 13: Monitoring Office 365 Apps and Services

There's no shortage of reporting and analysis abilities in Office 365. In each admin center, you'll find unique reports and information about your users, their activities and behaviors, your content's protection, and so much more. This chapter covers how to procure reports on important and helpful topics that will enable you, as an administrator, to respond to risks and plan for growth in Office 365.

We'll be covering the following recipes in this chapter:

• Finding at-risk users
• Creating alerts for specific activities performed by users in OneDrive
• Reviewing mail handling to see spam and malware history
• Identifying your least active SharePoint sites
• Reviewing search activity across SharePoint site collections
• Checking the service health status and known issues
• Checking general usage data for Office 365 apps and services
• Checking Teams usage and user activity
• Monitoring...

Technical requirements

The only requirement to complete the recipes in this chapter is to be either a global administrator or another administrator with read permissions for the reports for specific apps and services being monitored. For example, if you're looking for Teams usage and user activity, a Teams administrator role would be sufficient. Global admins will have sufficient privileges for all recipes.

Finding at-risk users

At-risk users are users in your organization that have been flagged for behavior that seems out of the ordinary, mostly when signing in. It could be that the user's credentials have been compromised (showing suspicious activity consistent with such events), or perhaps just a false positive when a user is signing in when traveling. In this recipe, you'll learn how to find users that have been identified as at-risk and learn how to address them.

Getting ready

You need to be a global or security administrator or reader to complete this recipe.

How to do it…

1. Go to the Microsoft 365 Security admin center at https://security.microsoft.com.
2. Select Reports from the left-hand navigation menu and click Users at risk:

   Figure 13.1 – Users at risk link on the Reports page of the Microsoft 365 Security admin center

3. Select an at-risk user to view more details:

   Figure 13.2 – A selected at-risk user

4. A Details panel will...

Creating alerts for specific activities performed by users in OneDrive

As an administrator, you can create alerts to be notified when users perform certain actions in OneDrive for Business (or any other app). In this recipe, we'll focus on creating an alert for when users share OneDrive files externally.

Getting ready

You need to be a global administrator to complete this recipe.

How to do it…

1. Go to the Office 365 Security & Compliance Center at https://protection.office.com.
2. Select Alerts > Dashboard from the left navigation pane.
3. Select New alert policy from under Alert policies.
4. Define the Name, Description, Severity, and Category details of the alert:

   Figure 13.5 – Alert policy basic details configuration

5. Set the Activity is dropdown to Shared file externally and the Site collection URL is text box so that it includes your root OneDrive site collection followed by an asterisk, similar to https://natechamberlain-my.sharepoint...

Reviewing mail handling to see spam and malware history

Several of the reports available in the Office 365 Security & Compliance Center are related to mail handling. In this recipe, we'll explore how to analyze mail activity, specifically when looking for spam and malware history.

Getting ready

You need to be a global administrator, global reader, or reports reader to complete this recipe.

How to do it…

1. Go to the Office 365 Security & Compliance Center at https://protection.office.com.
2. Select Reports > Dashboard from the left-hand navigation menu:

   Figure 13.10 – Dashboard link on the left-hand navigation menu of the O365 Security & Compliance center

3. Scroll down and find Malware detected in email:

   Figure 13.11 – Malware detected in email card

4. Click the center of the report tile to maximize the report and see it in greater detail:

   Figure 13.12 – Selected card enlarged in detail

5. Go back to the dashboard and...

Identifying your least active SharePoint sites

It can be helpful to know which of your organization's SharePoint site collections are inactive or rarely used when reviewing sites for cleanup. A good governance strategy includes routinely reviewing existing site collections. In this recipe, we'll go through the steps to identify the least active SharePoint site collections in your tenant.

Getting ready

You need to be a global or SharePoint administrator, global reader, or reports reader to complete this recipe.

How to do it…

1. Go to the SharePoint Admin Center at https://YOURTENANT-admin.sharepoint.com.
2. Above the SharePoint site usage report, click Details:

   Figure 13.15 – SharePoint site usage report visual

3. Select the column header for Last activity date and choose Sort ascending:

   Figure 13.16 – Details for specific sites and last activity dates

4. The sites that are now listed at the top of the table are your least active sites....

Reviewing search activity across SharePoint site collections

Search activity reports from SharePoint site collections will help you and your governance team improve the search experience by taking actual user search behaviors into account when creating search enhancements such as bookmarks, promoted results, Q&A results, location results, and so on. In this recipe, we'll find the search activity reports in the SharePoint admin center.

Getting ready

You need to be a global or SharePoint administrator to complete this recipe.

How to do it…

1. Go to the SharePoint Admin Center at https://YOURTENANT-admin.sharepoint.com.
2. Select More features from the left-hand navigation menu:

   Figure 13.18 – More features link on the left-hand navigation menu of the SharePoint admin center

3. Under Search, click Open:

   Figure 13.19 – Open button for the Search settings

4. Click View Usage Reports.
5. From here, you can utilize several different search reports...

Checking the service health status and known issues

Service health lets you know about any current advisories or known incidents involving the apps and services included in your subscription. You're also able to report issues you've noticed from the Service health page. In this recipe, we'll locate Service health.

Getting ready

You need to be a global or service administrator or reader to complete this recipe.

How to do it…

1. Go to the Microsoft 365 admin center at https://admin.microsoft.com.
2. Select Show all from the left-hand navigation menu.
3. Click Health > Service health:

   Figure 13-21 – Service health link on the left-hand navigation menu of the Microsoft 365 admin center

4. The main table of the page shows each service, with those known to have incidents or advisories at the top. You'll also notice the Report an issue option here:

   Figure 13.22 – Service health statuses and known issues

5. Across the top, you&apos...

Checking general usage data for Office 365 apps and services

Office 365 has a single page that you can us to monitor usage for all Office 365 apps and services. These reports offer a glimpse into the usage and adoption of Office 365 throughout the organization and may help guide governance, training, and administration decisions. In this recipe, we'll navigate to and explore these reports.

Getting ready

You need to be a global administrator or reader to complete this recipe.

How to do it…

1. Go to the Microsoft 365 admin center at https://admin.microsoft.com.
2. Select Show all from the left-hand navigation menu.
3. Click Reports > Usage:

   Figure 13.24 – Usage link on the left-hand navigation menu of the Microsoft 365 admin center

4. Here, you can find a graphic representation of usage data for Microsoft 365 apps and services. By clicking on any one of the data cards, you will be taken to a larger version to dive into more detail where you will...

Checking Teams usage and user activity

As you deploy and administer Teams in your organization, it's helpful to know how to track usage and general user activity data. This insight allows you to gauge adoption and opportunities. In this recipe, we'll locate Teams usage and user activity from the Teams admin center.

Getting ready

You need to be a global or Teams administrator to complete this recipe.

How to do it…

1. Go to the Teams admin center at https://admin.teams.microsoft.com.
2. Select Analytics & reports > Usage reports from the left-hand navigation menu:

   Figure 13.26 – Usage reports link on the left-hand navigation menu of the Microsoft Teams admin center

3. Select Teams usage or Teams user activity from the Report dropdown and choose a time span the report should cover (the last 7, 30, or 90 days). Then, click Run report:

   


   Figure 13.27 – Teams usage report options

4. The Teams usage report shows you specific Teams...

Monitoring Power Apps and Power Automate usage

In this recipe, you'll locate information on Power Apps and Power Automate active users and flow runs. This can be helpful to gauge adoption, but also look at the usage of limited subscription allowances.

Getting ready

You need to be a global or Power Platform service administrator to complete this recipe.

How to do it…

1. Go to the Power Platform admin center at https://admin.powerplatform.microsoft.com.
2. Select Analytics > Power Automate from the left-hand navigation menu:

   


   Figure 13.30 – Power Automate analytics link on the left-hand navigation menu of the Power Platform admin center

3. Power Automate analytics shows you flow runs, usage, flows created, errors, flows shared, and connector usage stats over time. Click through each of the tabs along the top:

   


   Figure 13.31 – Power Automate runs visuals

4. Select Analytics > Power Apps from the left-hand navigation menu:

   
...