Microsoft Teams Emoji Reactions
Teams Emoji Reactions
Query
CloudAppEvents
| where Application == "Microsoft Teams"
| where ActionType == "ReactedToMessage"
| extend Emoji = tostring(RawEventData.MessageReactionType)
| where isnotempty(Emoji)
| summarize TotalUsage = count() by Emoji
| sort by TotalUsageAbout this query
Microsoft Teams Emoji Reactions
Query Information
Description
This query lists the statistics of the Emoji reactions that have been send via Microsoft Teams
Defender XDR
Sentinel
CloudAppEvents
| where Application == "Microsoft Teams"
| where ActionType == "ReactedToMessage"
| extend Emoji = tostring(RawEventData.MessageReactionType)
| where isnotempty(Emoji)
| summarize TotalUsage = count() by Emoji
| sort by TotalUsage
Explanation
This query is designed to analyze and summarize the usage of emoji reactions in Microsoft Teams. Here's a simple breakdown of what it does:
-
Data Source: It looks at events from Microsoft Teams, specifically focusing on actions where users have reacted to messages.
-
Filter Criteria:
- It filters the data to only include events related to Microsoft Teams.
- It further narrows down the events to those where the action type is "ReactedToMessage," meaning it only considers emoji reactions to messages.
-
Extracting Emoji Information:
- It extracts the type of emoji used in each reaction from the event data.
-
Filtering Non-Empty Emoji Reactions:
- It ensures that only reactions with an actual emoji are considered by filtering out any empty entries.
-
Summarizing Data:
- It counts how many times each type of emoji was used across all reactions.
-
Sorting Results:
- Finally, it sorts the emojis based on their total usage, likely in ascending order, to show which emojis are used the least to most frequently.
In summary, this query provides a list of emojis used in reactions on Microsoft Teams, along with how often each emoji was used, sorted by their frequency of use.
Details

Bert-Jan Pals
Released: October 20, 2024
Tables
CloudAppEvents
Keywords
CloudAppEventsMicrosoftTeamsEmojiReactions
Operators
whereextendtostringisnotemptysummarizecountbysort