Microsoft 365, Office 365 extension
- Latest Dynatrace
- Extension
- Published Oct 27, 2025
Monitor Microsoft 365 and Office 365 performance, usage, and availability.
Get insights into the status, usage, performance, and service availability of your Microsoft Office 365 tenant services. Understand service usage patterns over time for Mail, OneDrive, Teams, SharePoint, and Active Directory, as well as watch license consumption and activations. The Microsoft 365, Office 365 extension provides a one-stop, at-a-glance overview of Office 365 status so that you always know first if any service level quality degradations are mounting and can react before a serious business impact.
Get started
The Microsoft 365, Office 365 extension runs on Dynatrace ActiveGate and connects to your Microsoft 365 tenant to scrape performance metrics. You need to connect using credentials that are provisioned specifically for monitoring purposes.
Use cases
- Monitor your M365 tenant for usage, performance, and availability.
- Receive alerts on Microsoft 365 performance and usage anomalies and service availability degradations.
- Take proactive actions before M365 service irregularities affect a broad population of users.
- Analyze trends and baselines of the M365 services usage as well as raise alerts on anomalies detected.
Requirements
Required permissions
Below is the summary of the permissions the extension requires to work correctly, divided by API and feature set.
Microsoft GraphAuditLog.Read.AllCallRecords.Read.AllDirectory.Read.AllReports.Read.AllServiceHealth.Read.AllServiceMessage.Read.AllUser.Read.All
- Office 365 Exchange Online
ReportingWebService.Read.All
- Office 365 Management APIs
ActivityFeed.Read.AllActivityFeed.ReadDlpServiceHealth.Read
Requirements for examining O365 users
With the default settings of your O365 tenant, it's likely that you get user names similar to 094AFD4E2B89CEC128724DCAA572CA5F instead of user names like Giorgio Fiore. This is because all Microsoft 365 reports hide user details by default. You can change this setting in the O365 Admin Center. Refer to the Microsoft 365 Reports in the admin center pages for more details.
Compatibility information
- An ActiveGate where the extension is installed needs access to your Microsoft 365 admin portal by using the tenant ID and client ID specified in Settings.
- M365 API versions used include:
- Microsoft Entra ID
- MS Graph API: graph.microsoft.com/v1.0
- Office 365 Management API: manage.office.com/api/v1.0
- Office 365 Reporting Web Service: reports.office365.com
- Office 365 Reporting Regional Web Service: reports*.office.com
Activation and setup
To configure the monitoring access on your M365, you need to:
- Create a monitoring application
- Grant the necessary API permissions to the application
- Generate a client secret, which the extension uses to access data that the monitoring application exposes
Below are the steps required to configure the M365 tenant.
-
On the Azure admin portal, go to the Enterprise Applications tab.
-
Select + New Application at the top of the page, and then select + Create your own application at the top of the page. Name your new application, choose the Register an application to integrate with Microsoft Entra ID (App you're developing) option, and select Create.
The user-facing name can be changed, and the Single Tenant option should be selected. This type of application should not need a Redirect URI, so this can be left blank.
Once your application is registered, it should show up under Applications > App registrations > All applications.
-
Select the application name to edit its properties, and then select the API permissions menu. The application should start with only the
User.Readpermission under the Microsoft Graph API. -
Select + Add a permission > Microsoft Graph > Application Permissions.
- Add the permissions for Microsoft Graph. After that, do the following for Office 365 Exchange Online and Office 365 Management API's. If you cannot find an API listed on the Microsoft APIs page, select APIs my organization uses, and search for the name of the API.
- After all the permissions have been added, they need to be granted admin consent for MSFT.
-
After the permissions and roles have been granted, create a secret key.
- Go to the Certificates & secrets tab, and select + New client secret.
- Choose a name for the client secret, and select the duration for which the client secret should be valid.
- Ensure to copy the Value column when the secret is created because this field is required and cannot be accessed later. This value is the
client_secretused in the extension configuration.
-
For the last two configuration values, go to the Overview tab of the application. The tenant ID is the Directory (tenant) ID field and the client ID is the Application (client) ID. These values are the
tenant_idandclient_idused in the extension configuration.
Details
The Microsoft 365, Office 365 extension package contains:
- Scheduled scripts that periodically read metrics and logs from your M365 tenant
- Processing rules that extract only necessary data to report on performance and drop any other M365 user data before it is ingested to the Dynatrace store
- A sample dashboard offering Office 365 services status
- Sample alert definitions
- Unified analysis views that provide access to all collected metrics
Monitored entities
The extension collects metrics for the specified tenant, in categories of:
- Tenant services status
- Outlook
- OneDrive
- Teams
- SharePoint
- Active Directory
- Licenses
Individual user insights offered by the extension
Additionally, the Microsoft 365, Office 365 extension can report on the service usage per individual user for emails, Teams, SharePoint, and OneDrive. Enable per-user-reports feature set to record a log of the service usage per each user. There are metrics derived from these log records too; look for the metric IDs starting with log.o365*.
Note that the service usage log is not the log of individual user actions. Service usage data provides information on the number of actions taken by the user (for example, the number of emails sent over past seven days) or space used by the user (for example, user's email inbox size), but not on the user activity (for example, when a user sent an email, what the email subject was, or what the email size was).
Licensing and cost
There is no charge for obtaining the Microsoft 365, Office 365 extension, only for the data that the extension ingests. The details of license consumption depend on the licensing model you are using. This is either the Dynatrace classic licensing or the Dynatrace Platform Subscription (DPS) model.
Metrics
License consumption is based on the number of metric data points ingested. The following formula provides approximate annual data points ingested assuming all feature sets are enabled.
59 metrics * 60 minutes * 24 hours * 365 days data points per year per monitored M365 tenant
Logs
Note that in addition to metrics, some marginal log consumption occurs through ingestion of the O365 service status messages, and some additional log consumption occurs when the per-user-reports feature set is enabled.
Classic licensing
In the Dynatrace classic licensing model, metric ingestion consumes Davis data units (DDUs) at the rate of .001 DDUs per metric data point.
Multiply the above formula for annual data points by .001 to estimate annual DDU usage.
Glossary of chart metrics
Chart name
Metrics
Description
API Reference
Service Health
office365.tenant.service.health
The current health of the different M365 services. Specifics on this value can be found in Q&A section What does the metric "office365.tenant.service.health" represent?
https://learn.microsoft.com/en-us/graph/api/serviceannouncement-list-healthoverviews?view=graph-rest-1.0&preserve-view=true&tabs=http
Users by Service
office365.tenant.services.user.counts
Number of active and inactive users for each M365 service, aggregated over a 7-day period. Data may be delayed up to 48 hours.
https://learn.microsoft.com/en-us/graph/api/reportroot-getoffice365servicesusercounts?view=graph-rest-1.0&tabs=http
Mailbox User Counts
office365.outlook.users
Number of Outlook users, split by type of operation.
https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#exchange-mailbox-schema
Email Activity Count
office365.outlook.email.activity
Count of Outlook activity operations, split by status, aggregated over a 7-day period. Data may be delayed up to 48 hours.
https://learn.microsoft.com/en-us/graph/api/reportroot-getemailactivitycounts?view=graph-rest-1.0&tabs=http
Active Mailboxes
office365.outlook.mailbox.used
Count of active Outlook mailboxes, aggregated over a 7-day period. Data may be delayed up to 48 hours.
https://learn.microsoft.com/en-us/graph/api/reportroot-getmailboxusagemailboxcounts?view=graph-rest-1.0&tabs=http
OneDrive Active Files
office365.onedrive.file.count.active
Number of active files in OneDrive.
SharePoint Active Files
office365.sharepoint.file.count.active
Number of active files in SharePoint.
AD Logins
office365.ad.logins / office365.ad.logins.failed
Number of successful and failed logins to Active Directory
https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#azure-active-directory-account-logon-schema
Active Mailboxes Percent
office365.outlook.mailbox.used.pct
Percentage of Mailboxes in use, aggregated over a 7-day period. Data may be delayed up to 48 hours.
https://learn.microsoft.com/en-us/graph/api/reportroot-getmailboxusagemailboxcounts?view=graph-rest-1.0&tabs=http
Mailbox Storage
office365.outlook.mailbox.storage
Amount of storage used by all Outlook mailboxes, aggregated over a 7-day period. Data may be delayed up to 48 hours.
https://learn.microsoft.com/en-us/graph/api/reportroot-getmailboxusagestorage?view=graph-rest-1.0&tabs=http
Quota Status
office365.outlook.quota.status[.under.limit, .warning.issued, .send.prohibited, .send.receive.prohibited, .indeterminate]
Count of each category of sent mail, aggregated over a 7-day period. Data may be delayed up to 48 hours.
https://learn.microsoft.com/en-us/graph/api/reportroot-getmailboxusagequotastatusmailboxcounts?view=graph-rest-1.0\&tabs=http
OneDrive Total Files
office365.onedrive.file.count.total
Total number of files in OneDrive divided by the site type, aggregated over a 7-day period. Data may be delayed up to 48 hours.
https://learn.microsoft.com/en-us/graph/api/reportroot-getonedriveusagefilecounts?view=graph-rest-1.0&tabs=http
OneDrive Storage
office365.onedrive.storage
Size of all storage in OneDrive divided by the site type, aggregated over a 7-day period. Data may be delayed up to 48 hours.
https://learn.microsoft.com/en-us/graph/api/reportroot-getonedriveusagestorage?view=graph-rest-1.0&tabs=http
OneDrive User Activity
office365.onedrive.active.users[.viewed.or.edited, .synced, .shared.internally, .shared.externally]
Count of all user operations in OneDrive divided by each operation, aggregated over a 7-day period. Data may be delayed up to 48 hours.
https://learn.microsoft.com/en-us/graph/api/reportroot-getonedriveactivityusercounts?view=graph-rest-1.0&tabs=http
Teams Activities
office365.teams.activity.counts
Count of the number of times each Teams activity was performed.
https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#microsoft-teams-schema
Teams Users
office365.teams.user.counts
Count of unique users that performed an activity on Teams.
https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#microsoft-teams-schema
SharePoint Total Files
office365.sharepoint.file.count.total
Count of all files in SharePoint split by site type and file type, aggregated over a 7-day period. Data may be delayed up to 48 hours.
https://learn.microsoft.com/en-us/graph/api/reportroot-getsharepointsiteusagefilecounts?view=graph-rest-1.0&tabs=http
SharePoint Storage
office365.sharepoint.storage
Size of all storage in SharePoint split by site, aggregated over a 7-day period. Data may be delayed up to 48 hours.
https://learn.microsoft.com/en-us/graph/api/reportroot-getsharepointsiteusagestorage?view=graph-rest-1.0&tabs=http
SharePoint User Activity
office365.sharepoint.active.users[.visited_page, .viewed.or.edited, .synced, .shared.internally, .shared.externally]
Count of all user operations in SharePoint divided by each operation, aggregated over a 7-day period. Data may be delayed up to 48 hours.
https://learn.microsoft.com/en-us/graph/api/reportroot-getsharepointactivityusercounts?view=graph-rest-1.0&tabs=http
SharePoint Visted Pages/Sites
office365.sharepoint.visited.pages.sites
Count of all SharePoint Pages and Sites that were visited.
https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#enum-sharepointauditoperation---type-edmint32
Licenses Activations
office365.tenant.activation.counts[.windows, .mac, .android, .ios, .windows.mobile]
Count of all license activations divided by device type. Data may be delayed up to 48 hours.
https://learn.microsoft.com/en-us/graph/api/reportroot-getoffice365activationcounts?view=graph-rest-1.0&tabs=http
Licenses Service Users
office365.tenant.services.user.counts
Count of M365 services users divided by activity and service type, aggregated over a 7-day period. Data may be delayed up to 48 hours.
https://learn.microsoft.com/en-us/graph/api/reportroot-getoffice365servicesusercounts?view=graph-rest-1.0&tabs=http
Licenses Activations
office365.tenant.activated.enabled[.assigned, .activated, .shared.activation]
Count of M365 license activations divided by activation status. Data may be delayed up to 48 hours.
https://learn.microsoft.com/en-us/graph/api/reportroot-getoffice365activationsusercounts?view=graph-rest-1.0&tabs=http
FAQ
What is the metric data resolution and delay?
Data is collected from the Microsoft portal every 5 minutes. Typical delays for data available through Microsoft APIs are within the 15-30 minute range. However, some metrics are available in 1-day resolution only and always reflect yesterday's status:
- License consumption and activations
- Mailbox counts, including information on which mailboxes are active and inactive and which mailboxes are in specific quota categories
- Storage (including storage for mail, OneDrive, and SharePoint)
Why does the extension need the x.read.all permissions on audit logs? Is it possible to specify more limited permissions?
The Microsoft 365, Office 365 extension uses audit logs to count users of the O365 services and, optionally, to report user usage of the O365 services. Note that the service usage log is not the log of individual user actions. Service usage data provides information on the number of actions taken by the user (for example, the number of emails sent over past seven days) or space used by the user (for example, user's email inbox size), but not on user activity (for example, when a user sent an email, what the email subject was, or what the email size was).
What guarantees can you provide that the extension only accesses the minimum required data and that these permissions are truly the only option available?
The Microsoft 365, Office 365 extension uses publicly available Microsoft APIs on the levels that are required to obtain metrics that the extension offers.
For example, to know the number of service users, we need to calculate the number of users from the list of service users. Microsoft APIs assure confidentiality here by obfuscating user names, which is done by default. This way, the number of users can be calculated without checking the user names. However, if you need to know what the service usage per individual user name is, you need to disable user name obfuscation in the admin center of your O365 tenant. You remain in control of what kind of information is processed by the extension.
Also, the extension code can be scrutinized. Download extension package from the public hub and look inside the zip to analyze the code.
Since the extension has access to the audit logs, can I use it to monitor change events in my O365 environment?
No. The Microsoft 365, Office 365 extension uses audit logs only to count service users. No change logs are recorded or exported by the extension. You need to set up audit log forwarding to your Dynatrace tenant separately.
Why are some metric timestamps skewed from when the event actually occurred?
Metrics may not be accurate to the minute they are reported at in Dynatrace. The Office 365 API has to process the data before it can be retrieved by the extension. This means the metric timestamps for graph API could vary 5–15 minutes from the time of the actual event as shown in Office 365. Metrics reported from the Management API may be 2–4 hours behind the actual time shown in Office 365 but can take as long as 6 hours.
Why is the email activity count flat over the day and delayed for a day?
The email activity metric is a tricky one; we are looking for ways to provide near-real-time email activity summaries. Any advice in this regard is welcome. Please use a dedicated thread in the Dynatrace Community to provide feedback.
What does the `office365.tenant.service.health` metric represent?
The office365.tenant.service.health metric represents the current health of the different M365 services. The specific service recorded by a metric line can be determined by looking at the "service" dimension. The value of the "Service Health Status" metric is calculated using a mapping between the possible status of each service to a numerical value.
Number
Status
Description
0
serviceOperational
The service is healthy, and no issues have been identified.
1
falsePositive
After a detailed investigation, the service is confirmed to be healthy and operating as designed. No impact to the service was observed or the cause of the incident originated outside of the service. Incidents and advisories with this status appear in the history view until they expire (after the period of time stated in the final post for that event).
2
serviceRestored
The corrective action has resolved the underlying problem and the service has been restored to a healthy state. To find out what went wrong, view the issue details.
3
postIncidentReviewPublished
A post-incident report for a specific issue that includes root cause information has been published, with next steps to ensure a similar issue doesn't recur.
4
verifyingService
The action has been taken to mitigate the issue, and we have verified that the service is healthy.
5
restoringService
The cause of the issue has been identified, and action is being taken to bring the service back to a healthy state.
6
extendedRecovery
This status indicates that corrective action is in progress to restore the service to most users but will take some time to reach all the affected systems. You might also see this status if a temporary fix is made to reduce the impact while a permanent fix is waiting to be applied.
7
investigating
A potential issue was identified, and more information is being gathered about what's going on and the scope of impact.
8
investigationSuspended
If our detailed investigation of a potential issue results in a request for additional information from customers to allow the service team to investigate further, you'll see this status. If the service team needs you to act, they'll let you know what data or logs they need.
9
serviceDegradation
An issue is confirmed that may affect the use of a service or feature. You might see this status if a service is performing more slowly than usual, there are intermittent interruptions, or if a feature isn't working, for example.
10
serviceInterruption
You'll see this status if an issue is determined to affect the ability for users to access the service. In this case, the issue is significant and can be reproduced consistently.
These values increase as the corresponding service status becomes worse. Three tiers of service status can be used: values 0-4 are a healthy status, values 5-7 are in a warning state, and values 8 and above are considered an error status. These tiers are used in the default dashboard.
What are the APIs used by the extension?
The Microsoft 365, Office 365 extension collects data from the Microsoft Graph API and the Office 365 Management API. A Microsoft authentication endpoint is also used to retrieve authorization tokens. The specific API endpoint that is used depends on the type of Office 365 tenant that is being monitored. The extension allows for the tenant URL definitions, with defaults set to the Enterprise Tenant:
- Graph API: https://graph.microsoft.com
- Management API: https://manage.office.com
- Login: https://login.microsoftonline.com
Does the extension monitor Azure AD or Active Directory on-premises?
The Microsoft 365, Office 365 extension does not monitor Azure AD or Active Directory on-premises. This extension provides only two metrics related to O365 user interactions with AD:
- Number of logons
- Number of failed logons
Use Active Directory monitoring extensions to monitor Active Directory on-premises. Note that these extensions don't support Azure AD.
Feature sets
When activating your extension using monitoring configuration, you can limit monitoring to one of the feature sets. To work properly the extension has to collect at least one metric after the activation.
In highly segmented networks, feature sets can reflect the segments of your environment. Then, when you create a monitoring configuration, you can select a feature set and a corresponding ActiveGate group that can connect to this particular segment.
All metrics that aren't categorized into any feature set are considered to be the default and are always reported.
A metric inherits the feature set of a subgroup, which in turn inherits the feature set of a group. Also, the feature set defined on the metric level overrides the feature set defined on the subgroup level, which in turn overrides the feature set defined on the group level.
outlook
| Metric name | Metric key | Description |
|---|---|---|
| Active Users | office365.outlook.users | Number of unique users who are performing email activities. |
| Active Mailboxes | office365.outlook.mailbox.used | Count of active user mailboxes in the organization. Note: 1-day resolution and data typically available within 48 hours. |
| Active Mailboxes Percent | office365.outlook.mailbox.used.pct | Percentage of user mailboxes that are active. Note: 1-day resolution and data typically available within 48 hours. |
| Mailbox Storage | office365.outlook.mailbox.storage | Amount of mailbox storage (in bytes) used by the organization. Note: 1-day resolution and data typically available within 48 hours. |
| Under Limit Status | office365.outlook.quota.status.under.limit | Quota under limit status count of all mailboxes of the organization. Note: 1-day resolution and data typically available within 48 hours. |
| Warning Issued Status | office365.outlook.quota.status.warning.issued | Quota warning issued status count of all mailboxes of the organization. Note: 1-day resolution and data typically available within 48 hours. |
| Send Prohibited Status | office365.outlook.quota.status.send.prohibited | Quota send prohibited status count of all mailboxes of the organization. Note: 1-day resolution and data typically available within 48 hours. |
| Send Receive Prohibited Status | office365.outlook.quota.status.send.receive.prohibited | Quota send receive prohibited status count of all mailboxes of the organization. Note: 1-day resolution and data typically available within 48 hours. |
| Indeterminate Status | office365.outlook.quota.status.indeterminate | Quota indeterminate status count of all mailboxes of the organization. Note: 1-day resolution and data typically available within 48 hours. |
| Email Activity | office365.outlook.email.activity | Count of all email activity for Outlook. Note: data may be delayed up to 24 hours. |
sharepoint
| Metric name | Metric key | Description |
|---|---|---|
| Active Files | office365.sharepoint.file.count.active | Total number of SharePoint active files. |
| Total Files | office365.sharepoint.file.count.total | Total number of SharePoint files. Note: 1-day resolution and data typically available within 48 hours. |
| Storage | office365.sharepoint.storage | SharePoint storage used and allocated. Note: 1-day resolution and data typically available within 48 hours. |
| Visited Page | office365.sharepoint.active.users.visited_page | Number of SharePoint active users who visited a page. Note: 1-day resolution and data typically available within 48 hours. |
| Viewed or Edited | office365.sharepoint.active.users.viewed.or.edited | Number of SharePoint active users who viewed or edited a file. Note: 1-day resolution and data typically available within 48 hours. |
| Synced | office365.sharepoint.active.users.synced | Number of SharePoint active users who synced a file. Note: 1-day resolution and data typically available within 48 hours. |
| Shared Internally | office365.sharepoint.active.users.shared.internally | Number of SharePoint active users who shared a file internally. Note: 1-day resolution and data typically available within 48 hours. |
| Shared Externally | office365.sharepoint.active.users.shared.externally | Number of SharePoint active users who shared a file externally. Note: 1-day resolution and data typically available within 48 hours. |
| Visited Pages/Sites | office365.sharepoint.visited.pages.sites | Total number of SharePoint Pages and Sites that have been visited. |
self-monitoring
| Metric name | Metric key | Description |
|---|---|---|
| Subscription URI Count | office365.sfm.subscription.uri.count | The number of URIs returned by the subscription API that the extension will use to collect data from. Can be split by the subscription dimension. |
| Subscription API Status Code | office365.sfm.subscription.http.status | The status codes of the subscription API calls. 0 means the calls were successful while 1 means they failed. Can be split by the status code dimension. |
| Subscription API Request Timeouts | office365.sfm.subscription.request.timeout | The amount of request timeouts for the subscription API endpoints. |
ad
| Metric name | Metric key | Description |
|---|---|---|
| AD Logins | office365.ad.logins | Count of total AD logins. |
| AD Logins Failed | office365.ad.logins.failed | Count of failed AD logins. |
onedrive
| Metric name | Metric key | Description |
|---|---|---|
| Active Files | office365.onedrive.file.count.active | Total number of active files in OneDrive. |
| Total Files | office365.onedrive.file.count.total | Total number of files in OneDrive. Note: 1-day resolution and data typically available within 48 hours. |
| Storage | office365.onedrive.storage | Total storage in bytes used by OneDrive. Note: 1-day resolution and data typically available within 48 hours. |
| Viewed or Edited | office365.onedrive.active.users.viewed.or.edited | Counts the times that OneDrive active users viewed or edited a file. Note: 1-day resolution and data typically available within 48 hours. |
| Synced | office365.onedrive.active.users.synced | Counts the times that OneDrive active users synced a file. Note: 1-day resolution and data typically available within 48 hours. |
| Shared Internally | office365.onedrive.active.users.shared.internally | Counts the times that OneDrive active users shared a file internally. Note: 1-day resolution and data typically available within 48 hours. |
| Shared Externally | office365.onedrive.active.users.shared.externally | Counts the times that OneDrive active users shared a file externally. Note: 1-day resolution and data typically available within 48 hours. |
per-user-reports
| Metric name | Metric key | Description |
|---|---|---|
| Exchange Emails Sent Count | log.o365_send_count | The amount of emails sent. Updated every 7D |
| Exchange Emails Received Count | log.o365_receive_count | The amount of emails received. Updated every 7D |
| Exchange Emails Read Count | log.o365_read_count | The amount of emails read. Updated every 7D |
| Teams Meetings Created | log.o365_meeting_created_count | The amount of teams meetings that were created. Updated every 7D |
| Teams Meetings Interacted With | log.o365_meeting_interacted_count | The amount of teams meetings that have been interacted with. Updated every 7D |
| Exchange Emails Stored | log.o365_email_item_count | The amount of emails stored. Updated every 7D |
| Exchange Emails Size | log.o365_email_storage_used | The size of stored emails. Updated every 7D |
| Email Warning Quota | log.o365_email_issue_warning_quota | The quota that once reached will warn users. Updated every 7D |
| Email Prohibit Quota | log.o365_email_prohibit_send_quota | The quota that once reached will prohibit users from sending emails. Updated every 7D |
| Email Send/Receive Quota | log.o365_email_prohibit_send_receive_quota | The maximum size a users inbox can be before preventing them from sending or receiving emails. Updated every 7D |
| Emails Deleted | log.o365_email_deleted_item_count | Number of emails deleted. Updated every 7D |
| Deleted Emails Size | log.o365_email_deleted_item_size | The size of deleted emails. Updated every 7D |
| Deleted Emails Quota | log.o365_email_deleted_item_quota | The quota that once reached will stop allowing users to recover deleted emails. Updated every 7D |
| SharePoint Pages Viewed | log.o365_sharepoint_page_view_count | The number of SharePoint pages viewed. Updated every 7D |
| SharePoint Pages Visited | log.o365_sharepoint_visited_page_count | The number of SharePoint pages visited. Updated every 7D |
| SharePoint Storage Usage | log.o365_sharepoint_storage_used | The usage in bytes of the root SharePoint folder. Updated every 7D |
| SharePoint Storage Allocated | log.o365_sharepoint_storage_allocated | Maximum amount of bytes that can be stored in SharePoint. Updated every 7D |
| OneDrive Storage Allocated | log.o365_onedrive_storage_used | Maximum amount of bytes that can be stored in OneDrive. Updated every 7D |
| OneDrive Storage Allocated | log.o365_onedrive_storage_allocated | Maximum amount of bytes that can be stored in OneDrive. Updated every 7D |
tenant-servicehealth
| Metric name | Metric key | Description |
|---|---|---|
| Service Health Status | office365.tenant.service.health | Gets the enumerated health of the service. serviceOperational=0, falsePositive=1, serviceRestored=2, postIncidentReviewPublished=3, verifyingService=4, restoringService=5, extendedRecovery=6, investigating=7, investigationSuspended=8, serviceDegradation=9, serviceInterruption=10. |
tenant-licenses
| Metric name | Metric key | Description |
|---|---|---|
| Windows Activations | office365.tenant.activation.counts.windows | Activation count for all windows devices across the organization. Note: 1-day resolution and data typically available within 48 hours. |
| Mac Activations | office365.tenant.activation.counts.mac | Activation count for all mac devices across the organization. Note: 1-day resolution and data typically available within 48 hours. |
| Android Activations | office365.tenant.activation.counts.android | Activation count for all android devices across the organization. Note: 1-day resolution and data typically available within 48 hours. |
| IOS Activations | office365.tenant.activation.counts.ios | Activation count for all ios devices across the organization. Note: 1-day resolution and data typically available within 48 hours. |
| Windows Mobile Activations | office365.tenant.activation.counts.windows.mobile | Activation count for all window mobile devices across the organization. Note: 1-day resolution and data typically available within 48 hours. |
| Service Users | office365.tenant.services.user.counts | User count across services by activity type. Note: 1-day resolution and data typically available within 48 hours. |
| Assigned Users | office365.tenant.activated.enabled.assigned | Number of users that have been assigned the subscription. Note: 1-day resolution and data typically available within 48 hours. |
| Activated Users | office365.tenant.activated.enabled.activated | Number of users that have activated the subscription. Note: 1-day resolution and data typically available within 48 hours. |
| Shared Activation Users | office365.tenant.activated.enabled.shared.activation | Number of users that have a shared computer activation of the subscription. Note: 1-day resolution and data typically available within 48 hours. |
| Sku Consumed Units | office365.tenant.sku_consumed | Count of Sku consumed units |
| Sku Prepaid Units | office365.tenant.sku_prepaid | Count of Sku prepaid units |
teams
| Metric name | Metric key | Description |
|---|---|---|
| Teams Activities | office365.teams.activity.counts | Total number of Teams activities. |
| Teams Users | office365.teams.user.counts | Total number of active Teams users. |
