Categories

Issue: Active/Inactive users on CoreView seems wrong 


CoreView relies on multiple sources of data from PowerShell, Exchange Web Services, Graph, Management API, Azure AD Audit, just to name a few.  


Data retrieved can have various latency (up to 72 hours) and some can be completely missing due to tenant configuration/restrictions. 


Solution:  

Here is step-by-step guide to troubleshoot the problem: 

 

  1. 1. Check if anonymous report is enabled   On your tenant, this scrambles all data and makes usage stats impossible to retrieve. (xtats data are still available in clear in many places on Microsoft Portal like: Teams Admin Center, Exchange Admin Center, Azure AD Admin Center. 

  1. Connect to Microsoft Admin Center - Settings - Org Settings – Reports 

  1. Verify that settings like in the picture below: 

Graphical user interface, text, application, email Description automatically generated 

 

  1. 2. Check Exchange Activity 

  1. Exchange Last Date is a complex matter on the Microsoft side, it is revised continually. Now the most precise information is retrieved from Graph and it's available in the Exchange Activity Report:  
    https://portal.coreview.com/Admin/20210104132649/#/exchangeReports/ExchangeEmailActivity 

  1. This date is updated by Microsoft if there are Mail Read or Mail Sent in the selected date range. 

  1. This data are retrieved from Graph API: https://docs.microsoft.com/en-us/graph/api/reportroot-getemailactivityuserdetail?view=graph-rest-1.0#response  

  1. Last activity date refers to the last time the user performed a read or send email activity. It is mapped on the field Last Exchange User Action Date. 

  1. https://docs.microsoft.com/en-us/microsoft-365/admin/activity-reports/email-activity-ww?view=o365-worldwide#interpret-the-email-activity-report  

  1. Note: it can happen that a User’s Disabled (Blocked Credentials) are marked as active in CoreView, this means that another user is accessing their resources (mainly happening for Mailboxes, OneDrive) 

    For users who do not have an Azure AD Logon but have a Last Exchange user interaction date, it could indicate that someone sent an email on behalf of the mailbox, which triggered the activity. To confirm this, you can check the Mail Traffic report by the user and filter it accordingly.

  1. 3. Check Teams Activity 

  1. Teams Activity is retrieved from Teams Users Activity Report: 

https://portal.coreview.com/Admin/20210104132649/#/teamsReports/teamsUserActivity 

  1. This date is updated by Microsoft if there is any user interaction with Teams 

  1. This is mapped on the field Teams Last Activity Date 

  1. Last Activity Date (UTC) refers to the last date that the user participated in a Microsoft Teams activity. 

  • Channel messages is the number of unique messages that the user posted in a team chat during the specified time period. 

  1. https://docs.microsoft.com/en-us/microsoftteams/teams-analytics-and-reports/user-activity-report 

  1. Note: opening client is not considered activity.     

  1. 4. Check OneDrive Activity 

  1. OneDrive Activity is retrieved from OneDrive Activity Report https://portal.coreview.com/Admin/20210126124053/#/OneDriveReports/oneDriveActivity 

  1. This date is updated by Microsoft if there is any user interaction with OneDrive 

  1. This is mapped on the field Last OneDrive Logon 

  1. 5. Check SharePoint Activity 

  1. SharePoint Activity is retrieved from SharePoint Activity Report https://portal.coreview.com/Admin/20210126124053/#/sharepointReports/sharepointActivity 

  1. This date is updated by Microsoft if there is any user interaction with SharePoint 

  1. This is mapped on the field SharePoint Last Action 

  • The latest date a file activity was performed or a page was visited for the selected date range. To see activity that occurred on a specific date, select the date directly in the chart.  

  1. 6. Check Power BI Pro Activity 

  1. Power BI Pro activity is not tracked by Microsoft in standard API / Reports. We are combining multiple sources of info to get last time a user with a Power BI Pro license has done any activity on Power BI (Here detailed list: https://docs.microsoft.com/en-us/power-bi/admin/service-admin-auditing)  

  1. This date is mapped on the field PowerBI Last Action 


  1. 7. Check Dynamics 365 Activity 

  1. Dynamics 365 activity is not tracked by Microsoft in standard API / Reports. We are combining multiple sources of info to get last time a user with a Dynamic license has done any activity on Dynamics 

  1. This date is mapped on the field Crm Last Activity Date 

  1. Note: Dynamics 365 must be configured to send audit to Microsoft Unified Log for this tracking to work 


  1. 8. Check Skype Activity 

  1. Skype Activity is retrieved from Skype Activity Report https://portal.coreview.com/Admin/20210126124053/#/skypeReports/skypeActivity 

  1. This date is updated by Microsoft if there is any user interaction with Skype 

  1. This is mapped on the field Skype Last Logon 

  1. Note: opening client is not considered activity. 


  1. 9. Check Yammer Activity 

  1. Yammer Activity is retrieved from Yammer Activity Report https://portal.coreview.com/Admin/20210126124053/#/yammerReports/yammerActivity 

  1. This date is updated by Microsoft if there is any user interaction with Yammer 

  1. This is mapped on the field Yammer Last Activity Date 

  • The last date that the user posted, read, or liked a message.  

  1. 10. Check M365 Activity  

'Last M365 Activity Date' refers to the max date between all activity dates tracked: 

  • LastExUserActionTime,
  • OneDriveLastAction,
  • YammerLastActivityDate, 
  • CrmLastActivityDate,
  • LyncLastActivityTime,
  • TeamsLastActivityDate,
  • PowerBILastAction,
  • SharePointLastAction,
  • M365ClientAppLastActivityDate


Note: Last Azure AD Logon is not considered, because identity is a basic service covered by free licenses. Logon does not mean usage of