Data Collection

What data is collected

This solution can store analytics data for the following metrics for Microsoft 365, if fully enabled. For the data-collection architecture and Azure costs, see Architecture & costs.

Note: depending on your requirements, not all areas of the solution need to be fully enabled. For all the data to be recorded for each area various permissions are needed, but if only a specific subset of statistics is required, the solution can work on a subset of permissions where appropriate. See Prerequisites → Permissions.

SharePoint Online (Web and Audit Log)

Usage focused on web-traffic & file usage activity.

Element	Description
Web-browsing: page hits, clicks & user sessions	Browser sessions (start & end browsing). Hits in each session with time on page. Performance data – server-side & client-side rendering times. User location information: country, province, city. Browser & device used. Hit associated site-collection & web. Links clicked on in each page of a session. Link text, CSS class names, and URL.
File activity	File events: view, edit, delete etc, for any files in the configured sites.
Searches	Searches made from the SharePoint Online website.
Pages metadata	All page properties & metadata associated with visited pages; list properties & taxonomies.
Page comments and likes	For SharePoint pages with comments and likes (for the page), they are read by the JavaScript tracker and stored in the SQL database. Comments are stored too with a sentiment score & detected language if a text analytics service is configured.

Link clicks tracked where possible. Some links suppress click events so cannot be seen by our tracking code.

SharePoint Usage

Element	Description
SharePoint user activity, daily. More information on fields in activity reports: https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/activity-reports?view=o365-worldwide#which-activity-reports-are-available-in-the-admin-center	By user: Files viewed or edited. Files synced. Files shared internally. Files shared externally.
SharePoint site activity, weekly	By site per week: External Sharing count File Count Active File Count Page View Count Visited Page Count Anonymous Link Count Company Link Count Secure Link for Guest Count Secure Link for Member Count Storage Used (Byte) Storage Allocated (Byte)

Teams & Calls

Statistics focused on adoption. All information is historical, and a snapshot kept each day the solution is running.

Element	Description
Teams	Owners & membership. Channels (see below). Add-ins & tabs deployed.
Channels in Teams	Tabs deployed. Chat count. Sentiment score of chats. Chat keywords. Chat languages.
Teams user activity. More information on fields: https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/microsoft-teams-user-activity-preview?view=o365-worldwide	By user: Private chat count. Team chat count. Calls count. Meetings count. Ad-hoc meetings attended count. Ad-hoc meetings organized count. Meetings attended count. Meetings organized count. Scheduled one-time meetings attended count. Scheduled one-time meetings organized count. Scheduled recurring meetings attended count. Scheduled recurring meetings organized count. Audio duration seconds. Video duration seconds. Screenshare duration seconds.
Teams’ user device activity	If each user has used: Web interface. iOS. Android. Windows Phone. Mac. Windows.
Calls & meetings	Call start & end. Type (group/peer2peer). Call organizer. "Sessions" (each connected person is a separate session) Start & end. Attendee. Modalities (audio/video/screenshare). Quality feedback given (if any): Star-rating. Comments. Failures detected (if any): Reason. Stage.

Outlook Usage

High-level Outlook usage statistics.

Element	Description
User activity. More information on fields in activity reports: https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/activity-reports?view=o365-worldwide#which-activity-reports-are-available-in-the-admin-center	By user: Email send count. Email receive count. Email read count. Meeting created count. Meeting interacted count.
Sent emails (optional). Read directly from each user's sentitems folder via the Graph delta query. Requires the Mail.Read Graph application permission.	Per recipient of each sent message: subject, sent date/time, sender address, recipient address, and (optional) Azure AI Language positive-sentiment score for the message body.

OneDrive Usage

Statistics focused on adoption. All information is historical, and a snapshot kept each day the solution is running.

Element	Description
User activity. More information on fields in activity reports: https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/activity-reports?view=o365-worldwide#which-activity-reports-are-available-in-the-admin-center	By user: Files viewed or edited. Files synced. Files shared internally. Files shared externally. Storage used in bytes. Active file count. Total file count.

Yammer Messages & Usage

Statistics focused on groups & user activity. All information is historical, and a snapshot kept each day the solution is running.

Element	Description
Yammer activity. More information on fields in activity reports: https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/activity-reports?view=o365-worldwide#which-activity-reports-are-available-in-the-admin-center	By user: Posted count. Read count. Liked count. By group: Posted count. Read count. Liked count. Member count By all messages (global - in preview): Total count. Likes count. Replies count. Followers count.

User Apps and Platforms Usage

Statistics that provides the details about which apps and platforms users have used, each day the solution is running.

Element	Description
Microsoft 365 apps usage https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/microsoft365-apps-usage-ww?view=o365-worldwide	By user: Apps (Outlook, Word, Excel, PowerPoint, OneNote, and Teams) Platforms (Windows, Mac, Web, and Mobile)

Per-user Teams apps tracking (removed)

Removed in Stable build 1807. The solution used to record which Teams apps each user had installed, one row per user per app per day, via TeamsAppInstallation.ReadForUser.All and the GraphUserApps flag.

It was removed because it grew faster than anything else in the schema for a report almost nobody used. What this means in practice:

• The import is gone. No new per-user app-install data is collected.
• detail?category=app-installs in User Data Lookup returns HTTP 400. Any script or integration calling it directly will start failing.
• GraphUserApps is no longer a config setting. Older saved configs still load — the flag is ignored.
• TeamsAppInstallation.ReadForUser.All is no longer needed and can be revoked.
• Existing history is not deleted. The three add-on tables are dropped only if all three are empty; if you hold data they are retained read-only, along with their reporting views — but reachable only via SQL and those views, not the API.

Stream Activity

Statistics focused on stream activity. All information is historical, and a snapshot kept each day the solution is running.

Element	Description
Stream activity. More information on Stream events - https://techcommunity.microsoft.com/t5/microsoft-stream-archive/microsoft-stream-audit-events-now-in-office-365-security-amp/ba-p/285203	By user: Videos watched & edited, with which client application. Streams-to-Yammer post relation for embedded streams.

Misc Audit Data

Given we already scan the audit logs for SharePoint, other workloads can be imported too, although by default this is disabled.

Element	Description
Exchange audit events	Operation (i.e., "New-Mailbox") User Timestamp
General audit events	Operation (i.e., "ViewReport"). User. Timestamp.
Azure AD events	Operation (i.e., "UserLoggedIn"). User. Timestamp.

User Information & Attributes

For all users seen by the system & active in Azure AD, this information is read and stored:

Element	Description
Users	Email. UPN. Office location. Usage location. Company name. Department. Job title. Manager. Azure AD identifier.
User SKUs	Assigned SKU for each user.

The SQL database table schema is explained in Database schema.

Copilot Events

Element	Description
Interactions with copilot (new chat thread)	Date. User. App host. Copilot agent (including custom agents). Estimated credit consumption. See https://learn.microsoft.com/en-us/office/office-365-management-api/copilot-schema
Files involved with copilot	File name, extension, URL, and site.
Meetings involved with copilot	Meeting name and ID.
Accessed resources	Resource ID, name, site URL, type, and sensitivity label.
AI models used	Model name (e.g. deep reasoning models).
Response messages	Message ID per copilot interaction.

Stable build 1807 additionally persists several fields the importer previously parsed and discarded: every interaction context (not just the first file or meeting), AI system plugins, accessed-resource actions, prompt messages and message sizes, thread ID, client region, Copilot log version, and AI model provider/version. There is no backfill — Management Activity API content is only retrievable for 7 days, so these are populated for newly imported interactions only and existing rows keep NULL. See Copilot → Fuller audit-field capture.

Copilot usage reports (optional)

Config flag: GraphCopilotUsageReports. Off by default. Needs Reports.Read.All. Global cloud only.

Microsoft's own official Copilot usage figures — the same ones the Microsoft 365 admin centre shows — pulled from Graph rather than inferred from the audit feed. Three reports: a user-count summary, a user-count trend, and per-user usage detail.

Element	Description
Copilot user counts	Enabled and active user counts per app and date.
Per-user Copilot usage detail	Per user and date: last activity date per Copilot app, and prompt counts per app on report version 2.

Copilot AI interaction history (optional)

Config flag: CopilotInteractionHistory. Off by default. Needs AiEnterpriseInteraction.Read.All — explicit admin consent, not granted by the installer.

Copilot prompt history. Prompt and response text are never stored.

Element	Description
Interaction statistics	Per interaction: body character and word counts, attachment / link / mention / context counts, response latency, app class, conversation type, locale, device, timestamp.
Language, sentiment, keywords	Only when Cognitive Services is configured. A detected language, a positive-sentiment confidence (0.0–1.0), and extracted keywords.

Privacy. With Cognitive Services configured, prompt text is sent to Azure AI Language for analysis and the extracted keywords are stored — and a keyword can amount to a whole short prompt. This is the one place user-authored content leaves the tenant. See Security Model → Copilot prompt content. Scope the import with UserGroupsFilter; it is tenant-wide otherwise.

Power Platform Adoption Events

Adoption-signal events for the Power Platform stack, read from both the legacy PowerApps/MicrosoftFlow audit workloads and the unified PowerPlatform admin activity feed (RecordType=256). No additional permissions are required beyond ActivityFeed.Read.

Prerequisite — Power Platform auditing must be turned on. No Power Platform adoption data will reach the database until a Power Platform / global admin enables auditing per production environment in Microsoft Purview. See the Prerequisites → Power Platform auditing must be turned on section for the full checklist (Purview tenant audit, per-environment audit, and the separate Power BI tenant audit toggle), plus the per-workload Microsoft Learn links.

Element	Description
Power Apps launches	App ID, app name, environment, session ID, client type (Web/Mobile/Teams/etc.).
Power Apps shares	App, recipient user, role granted.
Power Automate flow runs	Flow ID, flow name, environment, run ID.
Power Automate flow shares	Flow, recipient user, role granted.
Power BI activity	Workspace, report (with report type), and dashboard for adoption-relevant events such as ViewReport.
Copilot Studio bot events	Bot ID, name, environment.
Connectors used by apps/flows	Connector name, publisher, premium flag, with junction tables linking apps and flows to the connectors they use.

Sent Email (optional)

A new opt-in importer reads each user's sentitems folder via Microsoft Graph. Disabled by default; enable by adding SentEmails=True to the ImportJobSettings app setting and granting the Mail.Read Graph application permission.

Element	Description
Sent emails	Sender, subject, sent timestamp, Graph message ID.
Recipients	One row per (message, recipient address) in sent_email_recipients.
Sentiment score	Optional positive-sentiment score from Azure AI Language when Cognitive Services is enabled.