Microsoft 365, Office 365 extension
- Latest Dynatrace
- Extension
Monitor Microsoft 365 and Office 365 health, usage, and availability with Dynatrace to track Teams, SharePoint, OneDrive, Active Directory, and license metrics.
The extension monitors your Office 365 tenant performance in real time and alerts you to service degradations before they affect users.
Get started
The extension runs on Dynatrace ActiveGate and connects to your Microsoft 365 tenant using dedicated monitoring credentials.
Use cases
- Monitor your M365 tenant for usage, performance, and availability.
- Receive alerts on Microsoft 365 performance and usage anomalies and service availability degradations.
- Detect M365 service irregularities before they affect users.
- Analyze M365 service usage trends and baselines.
Requirements
Required permissions
The extension requires the following permissions, organized by API and feature set.
Microsoft GraphAuditLog.Read.AllCallRecords.Read.AllDirectory.Read.AllReports.Read.AllServiceHealth.Read.AllServiceMessage.Read.AllUser.Read.All
- Office 365 Exchange Online
ReportingWebService.Read.All
- Office 365 Management APIs
ActivityFeed.Read.AllActivityFeed.ReadDlpServiceHealth.Read
Requirements for examining O365 users
By default, Microsoft 365 reports hide user details, so you may see obfuscated names like 094AFD4E2B89CEC128724DCAA572CA5F instead of Giorgio Fiore. You can change this in the O365 Admin Center. See Microsoft 365 Reports in the admin center for details.
Compatibility information
- An ActiveGate where the extension is installed needs access to your Microsoft 365 admin portal by using the tenant ID and client ID specified in Settings.
- M365 API versions used include:
- Microsoft Entra ID
- MS Graph API: graph.microsoft.com/v1.0
- Office 365 Management API: manage.office.com/api/v1.0
- Office 365 Reporting Web Service: reports.office365.com
- Office 365 Reporting Regional Web Service: reports*.office.com
Activation and setup
To configure monitoring access for your M365, you need to:
- Create a monitoring application
- Grant the necessary API permissions to the application
- Generate a client secret for the extension
-
On the Azure admin portal, go to the Enterprise Applications tab.
-
Select New Application at the top of the page, and then select Create your own application. Name your new application, choose the Register an application to integrate with Microsoft Entra ID (App you're developing) option, and select Create.
You can change the user-facing name. Select Single Tenant and leave the Redirect URI blank.
The registered application appears under Applications > App registrations > All applications.
-
Select the application name, then select API permissions. By default, only the
User.ReadMicrosoft Graph permission is listed. -
Select Add a permission > Microsoft Graph > Application Permissions.
- Add the permissions for Microsoft Graph, then repeat for Office 365 Exchange Online and Office 365 Management APIs. If an API isn't listed under Microsoft APIs, select APIs my organization uses and search for it.
- After all the permissions have been added, they need to be granted admin consent.
-
After granting permissions, create a client secret.
- Go to the Certificates & secrets tab, and select New client secret.
- Choose a name and expiry duration for the client secret.
- Copy the Value column when the secret is created because this field is required and cannot be accessed later. This value is the
client_secretused in the extension configuration.
-
For the last two configuration values, go to the Overview tab of the application. The tenant ID is the Directory (tenant) ID field and the client ID is the Application (client) ID. These values are the
tenant_idandclient_idused in the extension configuration.
Details
The Microsoft 365, Office 365 extension package contains:
- Scheduled scripts that periodically read metrics and logs from your M365 tenant
- Processing rules that extract only the required data and drop all other M365 user data before ingestion
- A sample dashboard offering Office 365 services status
- Sample alert definitions
- Unified analysis views that provide access to all collected metrics
Monitored entities
The extension collects metrics in the following categories:
- Tenant services status
- Outlook
- OneDrive
- Teams
- SharePoint
- Active Directory
- Licenses
Individual user insights offered by the extension
The extension can also report service usage per individual user for emails, Teams, SharePoint, and OneDrive. Enable the per-user-reports feature set to record per-user usage logs. Metrics derived from these logs use IDs starting with log.o365*.
The service usage log is not a log of individual user actions. It records counts of actions and storage used per user (for example, emails sent in the past 7 days or inbox size), not event details such as email subjects or timestamps.
Glossary of chart metrics
| Chart name | Metrics | Description | API Reference |
|---|---|---|---|
Service Health | office365.tenant.service.health | The current health of the different M365 services. Specifics on this value can be found in Q&A section What does the metric "office365.tenant.service.health" represent? |
|
Users by Service | office365.tenant.services.user.counts | Number of active and inactive users for each M365 service, aggregated over a 7-day period. Data may be delayed up to 48 hours. |
|
Mailbox User Counts | office365.outlook.users | Number of Outlook users, split by type of operation. |
|
Email Activity Count | office365.outlook.email.activity | Count of Outlook activity operations, split by status, aggregated over a 7-day period. Data may be delayed up to 48 hours. |
|
Active Mailboxes | office365.outlook.mailbox.used | Count of active Outlook mailboxes, aggregated over a 7-day period. Data may be delayed up to 48 hours. |
|
OneDrive Active Files | office365.onedrive.file.count.active | Number of active files in OneDrive. | |
SharePoint Active Files | office365.sharepoint.file.count.active | Number of active files in SharePoint. | |
AD Logins | office365.ad.logins / office365.ad.logins.failed | Number of successful and failed logins to Active Directory |
|
Active Mailboxes Percent | office365.outlook.mailbox.used.pct | Percentage of Mailboxes in use, aggregated over a 7-day period. Data may be delayed up to 48 hours. |
|
Mailbox Storage | office365.outlook.mailbox.storage | Amount of storage used by all Outlook mailboxes, aggregated over a 7-day period. Data may be delayed up to 48 hours. |
|
Quota Status | office365.outlook.quota.status[.under.limit, .warning.issued, .send.prohibited, .send.receive.prohibited, .indeterminate] | Count of each category of sent mail, aggregated over a 7-day period. Data may be delayed up to 48 hours. |
|
OneDrive Total Files | office365.onedrive.file.count.total | Total number of files in OneDrive divided by the site type, aggregated over a 7-day period. Data may be delayed up to 48 hours. |
|
OneDrive Storage | office365.onedrive.storage | Size of all storage in OneDrive divided by the site type, aggregated over a 7-day period. Data may be delayed up to 48 hours. |
|
OneDrive User Activity | office365.onedrive.active.users[.viewed.or.edited, .synced, .shared.internally, .shared.externally] | Count of all user operations in OneDrive divided by each operation, aggregated over a 7-day period. Data may be delayed up to 48 hours. |
|
Teams Activities | office365.teams.activity.counts | Count of the number of times each Teams activity was performed. |
|
Teams Users | office365.teams.user.counts | Count of unique users that performed an activity on Teams. |
|
SharePoint Total Files | office365.sharepoint.file.count.total | Count of all files in SharePoint split by site type and file type, aggregated over a 7-day period. Data may be delayed up to 48 hours. |
|
SharePoint Storage | office365.sharepoint.storage | Size of all storage in SharePoint split by site, aggregated over a 7-day period. Data may be delayed up to 48 hours. |
|
SharePoint User Activity | office365.sharepoint.active.users[.visited_page, .viewed.or.edited, .synced, .shared.internally, .shared.externally] | Count of all user operations in SharePoint divided by each operation, aggregated over a 7-day period. Data may be delayed up to 48 hours. |
|
SharePoint Visted Pages/Sites | office365.sharepoint.visited.pages.sites | Count of all SharePoint Pages and Sites that were visited. |
|
Licenses Activations | office365.tenant.activation.counts[.windows, .mac, .android, .ios, .windows.mobile] | Count of all license activations divided by device type. Data may be delayed up to 48 hours. |
|
Licenses Service Users | office365.tenant.services.user.counts | Count of M365 services users divided by activity and service type, aggregated over a 7-day period. Data may be delayed up to 48 hours. |
|
Licenses Activations | office365.tenant.activated.enabled[.assigned, .activated, .shared.activation] | Count of M365 license activations divided by activation status. Data may be delayed up to 48 hours. |
|
Licensing and costs
There is no charge to use the extension. You are only charged for the data that the extension ingests.
The Microsoft 365, Office 365 extension ingests custom metrics, which consume Davis Data Units (DDUs) (Dynatrace classic license) or Metrics powered by Grail (DPS), according to your license model.
The extension ingests approximately 59 metric data points per minute per monitored M365 tenant.
In addition to metrics, some marginal log consumption occurs through ingestion of the O365 service status messages, and some additional log consumption occurs when the per-user-reports feature set is enabled.
Dynatrace Platform Subscription
In the Dynatrace Platform Subscription, metric ingestion consumes Metrics powered by Grail according to the number of ingested metric data points.
To calculate the approximate yearly consumption, apply the following calculation: <metric data points per minute> * 60 minutes * 24 hours * 365 days.
For the example above: 59 * 60 * 24 * 365 = 31,010,400 metric data points per year.
For logs, regular consumption applies. See Log Analytics.
Dynatrace classic license
In the classic licensing model, metric ingestion consumes Davis Data Units (DDUs) at the rate of .001 DDUs per metric data point. Multiply the above formula for annual data points by .001 to estimate annual DDU usage.
For the example above: 59 * 60 * 24 * 365 * 0.001 = 31,010.4 DDUs per year.
For logs, regular DDU consumption applies. See DDU consumption for Log Management and Analytics or DDUs for Log Monitoring Classic.
The DDU cost above does not include any possible log events or custom events that are triggered by the extension. For more information, see DDU events.
FAQ
What is the metric data resolution and delay?
Data is collected from the Microsoft portal every 5 minutes. Typical delays for data available through Microsoft APIs are within the 15-30 minute range. However, some metrics are available in 1-day resolution only and always reflect yesterday's status:
- License consumption and activations
- Mailbox counts, including information on which mailboxes are active and inactive and which mailboxes are in specific quota categories
- Storage (including storage for mail, OneDrive, and SharePoint)
Why does the extension need the x.read.all permissions on audit logs? Is it possible to specify more limited permissions?
The extension uses audit logs to count O365 service users and, optionally, report per-user service usage. The service usage log is not a log of individual user actions — it records counts of actions (for example, emails sent in the past 7 days) and storage usage per user, not activity details such as email subjects or timestamps.
What guarantees can you provide that the extension only accesses the minimum required data and that these permissions are truly the only option available?
The extension uses only the publicly available Microsoft APIs required for its metrics.
Microsoft APIs obfuscate user names by default, so user counts are calculated without exposing identities. To enable per-user-name reporting, disable obfuscation in the O365 Admin Center. You control what information the extension processes.
You can also inspect the extension code by downloading the package from the public hub and examining the zip contents.
Since the extension has access to the audit logs, can I use it to monitor change events in my O365 environment?
No. The Microsoft 365, Office 365 extension uses audit logs only to count service users. No change logs are recorded or exported by the extension. You need to set up audit log forwarding to your Dynatrace environment separately.
Why are some metric timestamps skewed from when the event actually occurred?
Metric timestamps are not real time. The Office 365 API processes data before the extension retrieves it, introducing delays: 5–15 minutes for Graph API metrics, and 2–6 hours for Management API metrics.
Why is the email activity count flat over the day and delayed for a day?
Email activity data does not currently support near-real-time summaries. To share feedback, use a dedicated thread in the Dynatrace Community.
What does the office365.tenant.service.health metric represent?
The office365.tenant.service.health metric represents the current health of the different M365 services. The specific service recorded by a metric line can be determined by looking at the "service" dimension. The value of the "Service Health Status" metric is calculated using a mapping between the possible status of each service to a numerical value.
Service Health Status values:
-
0 – serviceOperational
The service is healthy, and no issues have been identified. -
1 – falsePositive
After a detailed investigation, the service is confirmed to be healthy and operating as designed. No impact to the service was observed or the cause of the incident originated outside of the service. Incidents and advisories with this status appear in the history view until they expire (after the period of time stated in the final post for that event). -
2 – serviceRestored
The corrective action has resolved the underlying problem and the service has been restored to a healthy state. To find out what went wrong, view the issue details. -
3 – postIncidentReviewPublished
A post-incident report for a specific issue that includes root cause information has been published, with next steps to ensure a similar issue doesn't recur. -
4 – verifyingService
The action has been taken to mitigate the issue, and we have verified that the service is healthy. -
5 – restoringService
The cause of the issue has been identified, and action is being taken to bring the service back to a healthy state. -
6 – extendedRecovery
This status indicates that corrective action is in progress to restore the service to most users but will take some time to reach all the affected systems. You might also see this status if a temporary fix is made to reduce the impact while a permanent fix is waiting to be applied. -
7 – investigating
A potential issue was identified, and more information is being gathered about what's going on and the scope of impact. -
8 – investigationSuspended
If our detailed investigation of a potential issue results in a request for additional information from customers to allow the service team to investigate further, you'll see this status. If the service team needs you to act, they'll let you know what data or logs they need. -
9 – serviceDegradation
An issue is confirmed that may affect the use of a service or feature. You might see this status if a service is performing more slowly than usual, there are intermittent interruptions, or if a feature isn't working, for example. -
10 – serviceInterruption
You'll see this status if an issue is determined to affect the ability for users to access the service. In this case, the issue is significant and can be reproduced consistently.
These values increase as the corresponding service status becomes worse. Three tiers of service status can be used: values 0-4 are a healthy status, values 5-7 are in a warning state, and values 8 and above are considered an error status. These tiers are used in the default dashboard.
Which Office 365 services does this extension monitor for health?
The extension monitors only the Office 365 services in your subscription. Services not in your subscription are not reported, so no definitive list of monitored services exists.
What are the APIs used by the extension?
The extension collects data from the Microsoft Graph API and the Office 365 Management API, and uses a Microsoft authentication endpoint for authorization tokens. Endpoint URLs depend on your tenant type; the defaults target Enterprise tenants:
- Graph API: https://graph.microsoft.com
- Management API: https://manage.office.com
- Login: https://login.microsoftonline.com
Does the extension monitor Azure AD or Active Directory on-premises?
The extension does not monitor Azure AD or on-premises Active Directory. It provides only two AD-related metrics: logon count and failed logon count.
To monitor on-premises Active Directory, use Active Directory monitoring extensions. Note that these extensions don't support Azure AD.
Feature sets
When activating your extension using a monitoring configuration, you can limit monitoring to one of the feature sets. To work properly, the extension has to collect at least one metric after the activation.
In highly segmented networks, feature sets can reflect the segments of your environment. Then, when you create a monitoring configuration, you can select a feature set and a corresponding ActiveGate group that can connect to this particular segment.
All metrics that aren't categorized into any feature set are considered to be the default and are always reported.
A metric inherits the feature set of a subgroup, which in turn inherits the feature set of a group. Also, the feature set defined on the metric level overrides the feature set defined on the subgroup level, which in turn overrides the feature set defined on the group level.
onedrive
| Metric name | Metric key | Description |
|---|---|---|
| Active Files | office365.onedrive.file.count.active | Total number of active files in OneDrive. |
| Total Files | office365.onedrive.file.count.total | Total number of files in OneDrive. Note: 1-day resolution and data typically available within 48 hours. |
| Storage | office365.onedrive.storage | Total storage in bytes used by OneDrive. Note: 1-day resolution and data typically available within 48 hours. |
| Viewed or Edited | office365.onedrive.active.users.viewed.or.edited | Counts the times that OneDrive active users viewed or edited a file. Note: 1-day resolution and data typically available within 48 hours. |
| Synced | office365.onedrive.active.users.synced | Counts the times that OneDrive active users synced a file. Note: 1-day resolution and data typically available within 48 hours. |
| Shared Internally | office365.onedrive.active.users.shared.internally | Counts the times that OneDrive active users shared a file internally. Note: 1-day resolution and data typically available within 48 hours. |
| Shared Externally | office365.onedrive.active.users.shared.externally | Counts the times that OneDrive active users shared a file externally. Note: 1-day resolution and data typically available within 48 hours. |
ad
| Metric name | Metric key | Description |
|---|---|---|
| AD Logins | office365.ad.logins | Count of total AD logins. |
| AD Logins Failed | office365.ad.logins.failed | Count of failed AD logins. |
self-monitoring
| Metric name | Metric key | Description |
|---|---|---|
| Subscription URI Count | office365.sfm.subscription.uri.count | The number of URIs returned by the subscription API that the extension will use to collect data from. Can be split by the subscription dimension. |
| Subscription API Status Code | office365.sfm.subscription.http.status | The status codes of the subscription API calls. 0 means the calls were successful while 1 means they failed. Can be split by the status code dimension. |
| Subscription API Request Timeouts | office365.sfm.subscription.request.timeout | The amount of request timeouts for the subscription API endpoints. |
sharepoint
| Metric name | Metric key | Description |
|---|---|---|
| Active Files | office365.sharepoint.file.count.active | Total number of SharePoint active files. |
| Total Files | office365.sharepoint.file.count.total | Total number of SharePoint files. Note: 1-day resolution and data typically available within 48 hours. |
| Storage | office365.sharepoint.storage | SharePoint storage used and allocated. Note: 1-day resolution and data typically available within 48 hours. |
| Visited Page | office365.sharepoint.active.users.visited_page | Number of SharePoint active users who visited a page. Note: 1-day resolution and data typically available within 48 hours. |
| Viewed or Edited | office365.sharepoint.active.users.viewed.or.edited | Number of SharePoint active users who viewed or edited a file. Note: 1-day resolution and data typically available within 48 hours. |
| Synced | office365.sharepoint.active.users.synced | Number of SharePoint active users who synced a file. Note: 1-day resolution and data typically available within 48 hours. |
| Shared Internally | office365.sharepoint.active.users.shared.internally | Number of SharePoint active users who shared a file internally. Note: 1-day resolution and data typically available within 48 hours. |
| Shared Externally | office365.sharepoint.active.users.shared.externally | Number of SharePoint active users who shared a file externally. Note: 1-day resolution and data typically available within 48 hours. |
| Visited Pages/Sites | office365.sharepoint.visited.pages.sites | Total number of SharePoint Pages and Sites that have been visited. |
outlook
| Metric name | Metric key | Description |
|---|---|---|
| Active Users | office365.outlook.users | Number of unique users who are performing email activities. |
| Active Mailboxes | office365.outlook.mailbox.used | Count of active user mailboxes in the organization. Note: 1-day resolution and data typically available within 48 hours. |
| Active Mailboxes Percent | office365.outlook.mailbox.used.pct | Percentage of user mailboxes that are active. Note: 1-day resolution and data typically available within 48 hours. |
| Mailbox Storage | office365.outlook.mailbox.storage | Amount of mailbox storage (in bytes) used by the organization. Note: 1-day resolution and data typically available within 48 hours. |
| Under Limit Status | office365.outlook.quota.status.under.limit | Quota under limit status count of all mailboxes of the organization. Note: 1-day resolution and data typically available within 48 hours. |
| Warning Issued Status | office365.outlook.quota.status.warning.issued | Quota warning issued status count of all mailboxes of the organization. Note: 1-day resolution and data typically available within 48 hours. |
| Send Prohibited Status | office365.outlook.quota.status.send.prohibited | Quota send prohibited status count of all mailboxes of the organization. Note: 1-day resolution and data typically available within 48 hours. |
| Send Receive Prohibited Status | office365.outlook.quota.status.send.receive.prohibited | Quota send receive prohibited status count of all mailboxes of the organization. Note: 1-day resolution and data typically available within 48 hours. |
| Indeterminate Status | office365.outlook.quota.status.indeterminate | Quota indeterminate status count of all mailboxes of the organization. Note: 1-day resolution and data typically available within 48 hours. |
| Email Activity | office365.outlook.email.activity | Count of all email activity for Outlook. Note: data may be delayed up to 24 hours. |
teams
| Metric name | Metric key | Description |
|---|---|---|
| Teams Activities | office365.teams.activity.counts | Total number of Teams activities. |
| Teams Users | office365.teams.user.counts | Total number of active Teams users. |
tenant-licenses
| Metric name | Metric key | Description |
|---|---|---|
| Windows Activations | office365.tenant.activation.counts.windows | Activation count for all windows devices across the organization. Note: 1-day resolution and data typically available within 48 hours. |
| Mac Activations | office365.tenant.activation.counts.mac | Activation count for all mac devices across the organization. Note: 1-day resolution and data typically available within 48 hours. |
| Android Activations | office365.tenant.activation.counts.android | Activation count for all android devices across the organization. Note: 1-day resolution and data typically available within 48 hours. |
| IOS Activations | office365.tenant.activation.counts.ios | Activation count for all ios devices across the organization. Note: 1-day resolution and data typically available within 48 hours. |
| Windows Mobile Activations | office365.tenant.activation.counts.windows.mobile | Activation count for all window mobile devices across the organization. Note: 1-day resolution and data typically available within 48 hours. |
| Service Users | office365.tenant.services.user.counts | User count across services by activity type. Note: 1-day resolution and data typically available within 48 hours. |
| Assigned Users | office365.tenant.activated.enabled.assigned | Number of users that have been assigned the subscription. Note: 1-day resolution and data typically available within 48 hours. |
| Activated Users | office365.tenant.activated.enabled.activated | Number of users that have activated the subscription. Note: 1-day resolution and data typically available within 48 hours. |
| Shared Activation Users | office365.tenant.activated.enabled.shared.activation | Number of users that have a shared computer activation of the subscription. Note: 1-day resolution and data typically available within 48 hours. |
| Sku Consumed Units | office365.tenant.sku_consumed | Count of Sku consumed units |
| Sku Prepaid Units | office365.tenant.sku_prepaid | Count of Sku prepaid units |
tenant-servicehealth
| Metric name | Metric key | Description |
|---|---|---|
| Service Health Status | office365.tenant.service.health | Gets the enumerated health of the service. serviceOperational=0, falsePositive=1, serviceRestored=2, postIncidentReviewPublished=3, verifyingService=4, restoringService=5, extendedRecovery=6, investigating=7, investigationSuspended=8, serviceDegradation=9, serviceInterruption=10. |
per-user-reports
| Metric name | Metric key | Description |
|---|---|---|
| Exchange Emails Sent Count | log.o365_send_count | The amount of emails sent. Updated every 7D |
| Exchange Emails Received Count | log.o365_receive_count | The amount of emails received. Updated every 7D |
| Exchange Emails Read Count | log.o365_read_count | The amount of emails read. Updated every 7D |
| Teams Meetings Created | log.o365_meeting_created_count | The amount of teams meetings that were created. Updated every 7D |
| Teams Meetings Interacted With | log.o365_meeting_interacted_count | The amount of teams meetings that have been interacted with. Updated every 7D |
| Exchange Emails Stored | log.o365_email_item_count | The amount of emails stored. Updated every 7D |
| Exchange Emails Size | log.o365_email_storage_used | The size of stored emails. Updated every 7D |
| Email Warning Quota | log.o365_email_issue_warning_quota | The quota that once reached will warn users. Updated every 7D |
| Email Prohibit Quota | log.o365_email_prohibit_send_quota | The quota that once reached will prohibit users from sending emails. Updated every 7D |
| Email Send/Receive Quota | log.o365_email_prohibit_send_receive_quota | The maximum size a users inbox can be before preventing them from sending or receiving emails. Updated every 7D |
| Emails Deleted | log.o365_email_deleted_item_count | Number of emails deleted. Updated every 7D |
| Deleted Emails Size | log.o365_email_deleted_item_size | The size of deleted emails. Updated every 7D |
| Deleted Emails Quota | log.o365_email_deleted_item_quota | The quota that once reached will stop allowing users to recover deleted emails. Updated every 7D |
| SharePoint Pages Viewed | log.o365_sharepoint_page_view_count | The number of SharePoint pages viewed. Updated every 7D |
| SharePoint Pages Visited | log.o365_sharepoint_visited_page_count | The number of SharePoint pages visited. Updated every 7D |
| SharePoint Storage Usage | log.o365_sharepoint_storage_used | The usage in bytes of the root SharePoint folder. Updated every 7D |
| SharePoint Storage Allocated | log.o365_sharepoint_storage_allocated | Maximum amount of bytes that can be stored in SharePoint. Updated every 7D |
| OneDrive Storage Allocated | log.o365_onedrive_storage_used | Maximum amount of bytes that can be stored in OneDrive. Updated every 7D |
| OneDrive Storage Allocated | log.o365_onedrive_storage_allocated | Maximum amount of bytes that can be stored in OneDrive. Updated every 7D |
