Data Collection

What data is collected

This solution can store analytics data for the following metrics for Microsoft 365, if fully enabled. For the data-collection architecture and Azure costs, see Architecture & costs.

Note: depending on your requirements, not all areas of the solution need to be fully enabled. For all the data to be recorded for each area various permissions are needed, but if only a specific subset of statistics is required, the solution can work on a subset of permissions where appropriate. See Prerequisites → Permissions.

SharePoint Online (Web and Audit Log)

Usage focused on web-traffic & file usage activity.

Element	Description
Web-browsing: page hits, clicks & user sessions	Browser sessions (start & end browsing). Hits in each session with time on page. Performance data – server-side & client-side rendering times. User location information: country, province, city. Browser & device used. Hit associated site-collection & web. Links clicked on in each page of a session. Link text, CSS class names, and URL.
File activity	File events: view, edit, delete etc, for any files in the configured sites.
Searches	Searches made from the SharePoint Online website.
Pages metadata	All page properties & metadata associated with visited pages; list properties & taxonomies.
Page comments and likes	For SharePoint pages with comments and likes (for the page), they are read by the JavaScript tracker and stored in the SQL database. Comments are stored too with a sentiment score & detected language if a text analytics service is configured.

Link clicks tracked where possible. Some links suppress click events so cannot be seen by our tracking code.

SharePoint Usage

Element	Description
SharePoint user activity, daily. More information on fields in activity reports: https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/activity-reports?view=o365-worldwide#which-activity-reports-are-available-in-the-admin-center	By user: Files viewed or edited. Files synced. Files shared internally. Files shared externally.
SharePoint site activity, weekly	By site per week: External Sharing count File Count Active File Count Page View Count Visited Page Count Anonymous Link Count Company Link Count Secure Link for Guest Count Secure Link for Member Count Storage Used (Byte) Storage Allocated (Byte)

Teams & Calls

Statistics focused on adoption. All information is historical, and a snapshot kept each day the solution is running.

Element	Description
Teams	Owners & membership. Channels (see below). Add-ins & tabs deployed.
Channels in Teams	Tabs deployed. Chat count. Sentiment score of chats. Chat keywords. Chat languages.
Teams user activity. More information on fields: https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/microsoft-teams-user-activity-preview?view=o365-worldwide	By user: Private chat count. Team chat count. Calls count. Meetings count. Ad-hoc meetings attended count. Ad-hoc meetings organized count. Meetings attended count. Meetings organized count. Scheduled one-time meetings attended count. Scheduled one-time meetings organized count. Scheduled recurring meetings attended count. Scheduled recurring meetings organized count. Audio duration seconds. Video duration seconds. Screenshare duration seconds.
Teams’ user device activity	If each user has used: Web interface. iOS. Android. Windows Phone. Mac. Windows.
Calls & meetings	Call start & end. Type (group/peer2peer). Call organizer. "Sessions" (each connected person is a separate session) Start & end. Attendee. Modalities (audio/video/screenshare). Quality feedback given (if any): Star-rating. Comments. Failures detected (if any): Reason. Stage.

Outlook Usage

High-level Outlook usage statistics.

Element	Description
User activity. More information on fields in activity reports: https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/activity-reports?view=o365-worldwide#which-activity-reports-are-available-in-the-admin-center	By user: Email send count. Email receive count. Email read count. Meeting created count. Meeting interacted count.
Sent emails (optional). Read directly from each user's sentitems folder via the Graph delta query. Requires the Mail.Read Graph application permission.	Per recipient of each sent message: subject, sent date/time, sender address, recipient address, and (optional) Azure AI Language positive-sentiment score for the message body.

OneDrive Usage

Statistics focused on adoption. All information is historical, and a snapshot kept each day the solution is running.

Element	Description
User activity. More information on fields in activity reports: https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/activity-reports?view=o365-worldwide#which-activity-reports-are-available-in-the-admin-center	By user: Files viewed or edited. Files synced. Files shared internally. Files shared externally. Storage used in bytes. Active file count. Total file count.

Yammer Messages & Usage

Statistics focused on groups & user activity. All information is historical, and a snapshot kept each day the solution is running.

Element	Description
Yammer activity. More information on fields in activity reports: https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/activity-reports?view=o365-worldwide#which-activity-reports-are-available-in-the-admin-center	By user: Posted count. Read count. Liked count. By group: Posted count. Read count. Liked count. Member count By all messages (global - in preview): Total count. Likes count. Replies count. Followers count.

User Apps and Platforms Usage

Statistics that provides the details about which apps and platforms users have used, each day the solution is running.

Element	Description
Microsoft 365 apps usage https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/microsoft365-apps-usage-ww?view=o365-worldwide	By user: Apps (Outlook, Word, Excel, PowerPoint, OneNote, and Teams) Platforms (Windows, Mac, Web, and Mobile)

Stream Activity

Statistics focused on stream activity. All information is historical, and a snapshot kept each day the solution is running.

Element	Description
Stream activity. More information on Stream events - https://techcommunity.microsoft.com/t5/microsoft-stream-archive/microsoft-stream-audit-events-now-in-office-365-security-amp/ba-p/285203	By user: Videos watched & edited, with which client application. Streams-to-Yammer post relation for embedded streams.

Misc Audit Data

Given we already scan the audit logs for SharePoint, other workloads can be imported too, although by default this is disabled.

Element	Description
Exchange audit events	Operation (i.e., "New-Mailbox") User Timestamp
General audit events	Operation (i.e., "ViewReport"). User. Timestamp.
Azure AD events	Operation (i.e., "UserLoggedIn"). User. Timestamp.

User Information & Attributes

For all users seen by the system & active in Azure AD, this information is read and stored:

Element	Description
Users	Email. UPN. Office location. Usage location. Company name. Department. Job title. Manager. Azure AD identifier.
User SKUs	Assigned SKU for each user.

The SQL database table schema is explained in Database schema.

Copilot Events

Element	Description
Interactions with copilot (new chat thread)	Date. User. App host. Copilot agent (including custom agents). Estimated credit consumption. See https://learn.microsoft.com/en-us/office/office-365-management-api/copilot-schema
Files involved with copilot	File name, extension, URL, and site.
Meetings involved with copilot	Meeting name and ID.
Accessed resources	Resource ID, name, site URL, type, and sensitivity label.
AI models used	Model name (e.g. deep reasoning models).
Response messages	Message ID per copilot interaction.

Power Platform Adoption Events

Adoption-signal events for the Power Platform stack, read from both the legacy PowerApps/MicrosoftFlow audit workloads and the unified PowerPlatform admin activity feed (RecordType=256). No additional permissions are required beyond ActivityFeed.Read.

Prerequisite — Power Platform auditing must be turned on. No Power Platform adoption data will reach the database until a Power Platform / global admin enables auditing per production environment in Microsoft Purview. See the Prerequisites → Power Platform auditing must be turned on section for the full checklist (Purview tenant audit, per-environment audit, and the separate Power BI tenant audit toggle), plus the per-workload Microsoft Learn links.

Element	Description
Power Apps launches	App ID, app name, environment, session ID, client type (Web/Mobile/Teams/etc.).
Power Apps shares	App, recipient user, role granted.
Power Automate flow runs	Flow ID, flow name, environment, run ID.
Power Automate flow shares	Flow, recipient user, role granted.
Power BI activity	Workspace, report (with report type), and dashboard for adoption-relevant events such as ViewReport.
Copilot Studio bot events	Bot ID, name, environment.
Connectors used by apps/flows	Connector name, publisher, premium flag, with junction tables linking apps and flows to the connectors they use.

Sent Email (optional)

A new opt-in importer reads each user's sentitems folder via Microsoft Graph. Disabled by default; enable by adding SentEmails=True to the ImportJobSettings app setting and granting the Mail.Read Graph application permission.

Element	Description
Sent emails	Sender, subject, sent timestamp, Graph message ID.
Recipients	One row per (message, recipient address) in sent_email_recipients.
Sentiment score	Optional positive-sentiment score from Azure AI Language when Cognitive Services is enabled.