KQL Search

Query Details

Office Activity Summarize Teams Created Deleted

Query

//Create a weekly summary of Teams created and deleted in your Office 365 tenant

//Data connector required for this query - Office 365

OfficeActivity
| where TimeGenerated > ago(30d)
| where Operation in ("TeamCreated", "TeamDeleted")
| summarize
    ['Count of Teams Created']=dcountif(TeamName, Operation == "TeamCreated"),
    ['List of Teams Created']=make_set_if(TeamName, Operation == "TeamCreated"),
    ['Count of Teams Deleted']=dcountif(TeamName, Operation == "TeamDeleted"),
    ['List of Teams Deleted']=make_set_if(TeamName, Operation == "TeamDeleted")
    by Week=startofweek(TimeGenerated)
| sort by Week desc

Explanation

This query creates a weekly summary of Teams created and deleted in your Office 365 tenant. It uses the Office 365 data connector. It filters the data for the past 30 days and selects only the operations of "TeamCreated" and "TeamDeleted". It then summarizes the data by counting the number of Teams created and deleted, and also creates a list of the Teams created and deleted. The results are sorted by the week in descending order.

Details

Matt Zorich

Released: June 17, 2022

Tables

OfficeActivity

Keywords

OfficeActivityTimeGeneratedOperationTeamCreatedTeamDeletedCount of Teams CreatedList of Teams CreatedCount of Teams DeletedList of Teams DeletedWeek

Operators

whereagoinsummarizedcountifmake_set_ifbysort

Actions

GitHub