KQL Search

Query Details

Office Activity Summarize Teams App Installs

Query

//Summarize the applications installed into Teams in the last month. Apps are grouped into the scope they were installed to - Team, Chat or User and by name and application id

//Data connector required for this query - Office 365

OfficeActivity
| where TimeGenerated > ago (30d)
| where Operation == "AppInstalled"
| summarize
    ['App Installed to Team Scope']=countif(OperationScope == "Team"),
    ['App Installed to Chat Scope']=countif(OperationScope == "Chat"),
    ['App Installed to User Scope']=countif(OperationScope == "User")
    by AddonName, AzureADAppId
| sort by AddonName asc

Explanation

This query summarizes the applications installed in Teams in the last month. It groups the apps based on the scope they were installed to - Team, Chat, or User. It also includes the name and application ID of each app. The query requires the Office 365 data connector. The results are sorted alphabetically by the app name.

Details

Matt Zorich

Released: June 17, 2022

Tables

OfficeActivity

Keywords

OfficeActivityTimeGeneratedOperationAppInstalledOperationScopeTeamChatUserAddonNameAzureADAppIdsort

Operators

whereago==countifsummarizebysort by

Actions

GitHub