
# Microsoft 365 reports by HTTP

## Overview

- This template is designed to monitor Microsoft 365 by HTTP. It works without any external scripts and uses script items.
- The template uses endpoints in the Microsoft Graph API to gather daily metrics from weekly reports.
- The template is meant to be used as a long-term trend monitoring tool.

## Requirements

Zabbix version: 7.0 and higher.

## Tested versions

This template has been tested on:
- Microsoft 365

## Configuration

> Zabbix should be configured according to the instructions in the [Templates out of the box](https://www.zabbix.com/documentation/7.0/manual/config/templates_out_of_the_box) section.

## Setup

1. Register the app with your Microsoft Entra ID.
2. Configure Microsoft Graph application permissions on the app ID:
    - `Reports.Read.All` - required for app usage and activity metrics
    - `ServiceHealth.Read.All` - required for service discovery and service status metrics
3. Request administrator consent.
4. Configure the macros: `{$MS365.APP.ID}`, `{$MS365.PASSWORD}`, `{$MS365.TENANT.ID}`.

### Macros used

|Name|Description|Default|
|----|-----------|-------|
|{$MS365.APP.ID}|
Microsoft application ID.
||
|{$MS365.PASSWORD}|
The secret for the registered Microsoft application.
||
|{$MS365.TENANT.ID}|
Microsoft tenant ID.
||
|{$MS365.SERVICE.NAME.MATCHES}|
This macro is used in the Microsoft cloud service discovery rule.
|`.*`|
|{$MS365.SERVICE.NAME.NOT.MATCHES}|
This macro is used in the Microsoft cloud service discovery rule.
|`CHANGE_IF_NEEDED`|
|{$MS365.HTTP.PROXY}|
Sets the HTTP proxy value. If this macro is empty, then no proxy is used.
||
|{$MS365.API.TIMEOUT}|
API response timeout.
|`15s`|

### Items

|Name|Description|Type|Key and additional info|
|----|-----------|----|-----------------------|
|Services: Get services|
The list of Microsoft cloud services and their health statuses subscribed by a tenant.

More information:

https://learn.microsoft.com/en-us/graph/api/servicehealth-get?view=graph-rest-beta&tabs=http
|Script|ms365.services.get|
|Teams: Get reports|
Accumulated data from the Microsoft Graph API "reports" endpoints.

More information:

https://learn.microsoft.com/en-us/graph/api/resources/report?view=graph-rest-beta
|Script|ms365.teams.reports.get|
|Outlook: Get reports|
Accumulated data from the Microsoft Graph API "reports" endpoints.

More information:

https://learn.microsoft.com/en-us/graph/api/resources/report?view=graph-rest-beta
|Script|ms365.outlook.reports.get|
|OneDrive: Get reports|
Accumulated data from the Microsoft Graph API "reports" endpoints.

More information:

https://learn.microsoft.com/en-us/graph/api/resources/report?view=graph-rest-beta
|Script|ms365.onedrive.reports.get|
|SharePoint: Get reports|
Accumulated data from the Microsoft Graph API "reports" endpoints.

More information:

https://learn.microsoft.com/en-us/graph/api/resources/report?view=graph-rest-beta
|Script|ms365.sharepoint.reports.get|
|Apps: Get reports|
Accumulated data from the Microsoft Graph API "reports" endpoints.

More information:

https://learn.microsoft.com/en-us/graph/api/resources/report?view=graph-rest-beta
|Script|ms365.apps.reports.get|
|Services: Get errors|
A list of errors from API requests for Services metrics.
|Dependent item|ms365.services.errors
**Preprocessing**

- 
JSON Path: `$.error`

⛔️Custom on fail: Set value to: ``</p></li><li><p>Discard unchanged with heartbeat: `1h`

|
|Teams: Get errors|
A list of errors from API requests for Teams metrics.
|Dependent item|ms365.teams.errors
**Preprocessing**

- 
JSON Path: `$.error`

⛔️Custom on fail: Set value to: ``</p></li><li><p>Discard unchanged with heartbeat: `1h`

|
|Outlook: Get errors|
A list of errors from API requests for Outlook metrics.
|Dependent item|ms365.outlook.errors
**Preprocessing**

- 
JSON Path: `$.error`

⛔️Custom on fail: Set value to: ``</p></li><li><p>Discard unchanged with heartbeat: `1h`

|
|OneDrive: Get errors|
A list of errors from API requests for OneDrive metrics.
|Dependent item|ms365.onedrive.errors
**Preprocessing**

- 
JSON Path: `$.error`

⛔️Custom on fail: Set value to: ``</p></li><li><p>Discard unchanged with heartbeat: `1h`

|
|SharePoint: Get errors|
A list of errors from API requests for SharePoint metrics.
|Dependent item|ms365.sharepoint.errors
**Preprocessing**

- 
JSON Path: `$.error`

⛔️Custom on fail: Set value to: ``</p></li><li><p>Discard unchanged with heartbeat: `1h`

|
|Apps: Get errors|
A list of errors from API requests for Apps metrics.
|Dependent item|ms365.apps.errors
**Preprocessing**

- 
JSON Path: `$.error`

⛔️Custom on fail: Set value to: ``</p></li><li><p>Discard unchanged with heartbeat: `1h`

|
|Teams: Device usage (users), web client|
The number of unique licensed Microsoft Teams users recorded via the Teams web client over the week before the report refresh date.
|Dependent item|ms365.teams.device.users.web
**Preprocessing**

- 
JSON Path: `$.metrics.getTeamsDeviceUsageDistributionUserCounts[0].web`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: Device usage (users), Android|
The number of unique licensed Microsoft Teams users recorded via the Teams mobile client for Android over the week before the report refresh date.
|Dependent item|ms365.teams.device.users.android
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: Device usage (users), iOS|
The number of unique licensed Microsoft Teams users recorded via the Teams mobile client for iOS over the week before the report refresh date.
|Dependent item|ms365.teams.device.users.ios
**Preprocessing**

- 
JSON Path: `$.metrics.getTeamsDeviceUsageDistributionUserCounts[0].ios`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: Device usage (users), Mac|
The number of unique licensed Microsoft Teams users recorded via the Teams desktop client on a macOS computer over the week before the report refresh date.
|Dependent item|ms365.teams.device.users.mac
**Preprocessing**

- 
JSON Path: `$.metrics.getTeamsDeviceUsageDistributionUserCounts[0].mac`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: Device usage (users), Windows|
The number of unique licensed Microsoft Teams users recorded via the Teams desktop client on a Windows-based computer over the week before the report refresh date.
|Dependent item|ms365.teams.device.users.windows
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: Device usage (users), Chrome OS|
The number of unique licensed Microsoft Teams users recorded via the Teams desktop client on a ChromeOS computer over the week before the report refresh date.
|Dependent item|ms365.teams.device.users.chromeos
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: Device usage (users), Linux|
The number of unique licensed Microsoft Teams users recorded via the Teams desktop client on a Linux computer over the week before the report refresh date.
|Dependent item|ms365.teams.device.users.linux
**Preprocessing**

- 
JSON Path: `$.metrics.getTeamsDeviceUsageDistributionUserCounts[0].linux`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: Device usage (total), report date|
The date of the report of device usage of both licensed and non-licensed users.
|Dependent item|ms365.teams.device.total.report_date
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: Device usage (total), web client|
The number of unique Microsoft Teams users (licensed or non-licensed) recorded via the Teams web client over the week before the report refresh date.
|Dependent item|ms365.teams.device.total.web
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: Device usage (total), Android|
The number of unique Microsoft Teams users (licensed or non-licensed) recorded via the Teams mobile client for Android over the week before the report refresh date.
|Dependent item|ms365.teams.device.total.android
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: Device usage (total), iOS|
The number of unique Microsoft Teams users (licensed or non-licensed) recorded via the Teams mobile client for iOS over the week before the report refresh date.
|Dependent item|ms365.teams.device.total.ios
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: Device usage (total), Mac|
The number of unique Microsoft Teams users (licensed or non-licensed) recorded via the Teams desktop client on a macOS computer over the week before the report refresh date.
|Dependent item|ms365.teams.device.total.mac
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: Device usage (total), Windows|
The number of unique Microsoft Teams users (licensed or non-licensed) recorded via the Teams desktop client on a Windows-based computer over the week before the report refresh date.
|Dependent item|ms365.teams.device.total.windows
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: Device usage (total), Chrome OS|
The number of unique Microsoft Teams users (licensed or non-licensed) recorded via the Teams desktop client on a ChromeOS computer over the week before the report refresh date.
|Dependent item|ms365.teams.device.total.chromeos
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: Device usage (total), Linux|
The number of unique Microsoft Teams users (licensed or non-licensed) recorded via the Teams desktop client on a Linux computer over the week before the report refresh date.
|Dependent item|ms365.teams.device.total.linux
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: Device usage (guests), web client|
The number of unique non-licensed Microsoft Teams users (guests) recorded via the Teams web client over the week before the report refresh date.
|Dependent item|ms365.teams.device.guests.web
**Preprocessing**

- 
JavaScript: `The text is too long. Please see the template.`

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: Device usage (guests), Android|
The number of unique non-licensed Microsoft Teams users (guests) recorded via the Teams mobile client for Android over the week before the report refresh date.
|Dependent item|ms365.teams.device.guests.android
**Preprocessing**

- 
JavaScript: `The text is too long. Please see the template.`

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: Device usage (guests), iOS|
The number of unique non-licensed Microsoft Teams users (guests) recorded via the Teams mobile client for iOS over the week before the report refresh date.
|Dependent item|ms365.teams.device.guests.ios
**Preprocessing**

- 
JavaScript: `The text is too long. Please see the template.`

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: Device usage (guests), Mac|
The number of unique non-licensed Microsoft Teams users (guests) recorded via the Teams desktop client on a macOS computer over the week before the report refresh date.
|Dependent item|ms365.teams.device.guests.mac
**Preprocessing**

- 
JavaScript: `The text is too long. Please see the template.`

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: Device usage (guests), Windows|
The number of unique non-licensed Microsoft Teams users (guests) recorded via the Teams desktop client on a Windows-based computer over the week before the report refresh date.
|Dependent item|ms365.teams.device.guests.windows
**Preprocessing**

- 
JavaScript: `The text is too long. Please see the template.`

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: Device usage (guests), Chrome OS|
The number of unique non-licensed Microsoft Teams users (guests) recorded via the Teams desktop client on a ChromeOS computer over the week before the report refresh date.
|Dependent item|ms365.teams.device.guests.chromeos
**Preprocessing**

- 
JavaScript: `The text is too long. Please see the template.`

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: Device usage (guests), Linux|
The number of unique non-licensed Microsoft Teams users (guests) recorded via the Teams desktop client on a Linux computer over the week before the report refresh date.
|Dependent item|ms365.teams.device.guests.linux
**Preprocessing**

- 
JavaScript: `The text is too long. Please see the template.`

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: User activity, report date|
The date of the report of the number of activities by all users.
|Dependent item|ms365.teams.activity.user.report_date
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: User activity, team chat messages|
The number of unique messages that were posted in team chats by licensed or non-licensed Microsoft Teams users during the week before the report refresh date. This includes original posts and replies.
|Dependent item|ms365.teams.activity.user.messages.in_team
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: User activity, private chat messages|
The number of unique messages that were posted in private chats by licensed or non-licensed Microsoft Teams users during the week before the report refresh date.
|Dependent item|ms365.teams.activity.user.messages.private
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: User activity, calls|
The number of 1:1 calls licensed or non-licensed Microsoft Teams users participated in during the week before the report refresh date.
|Dependent item|ms365.teams.activity.user.calls
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: User activity, meetings|
The sum of the scheduled one-time and recurring, ad-hoc, and unclassified meetings licensed or non-licensed Microsoft Teams users participated in during the week before the report refresh date.
|Dependent item|ms365.teams.activity.user.meetings.total
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: User activity, organized meetings|
The sum of the scheduled one-time and recurring, ad-hoc, and unclassified meetings organized by licensed or non-licensed Microsoft Teams users during the week before the report refresh date.
|Dependent item|ms365.teams.activity.user.meetings.organized
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: User activity, attended meetings|
The sum of the scheduled one-time and recurring, ad-hoc, and unclassified meetings attended by licensed or non-licensed Microsoft Teams users during the week before the report refresh date.
|Dependent item|ms365.teams.activity.user.meetings.attended
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: User activity, audio duration|
The sum of the audio duration of licensed or non-licensed Microsoft Teams users during the week before the report refresh date.
|Dependent item|ms365.teams.activity.user.duration.audio
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

- 
JavaScript: `The text is too long. Please see the template.`

|
|Teams: User activity, video duration|
The sum of the video duration of licensed or non-licensed Microsoft Teams users during the week before the report refresh date.
|Dependent item|ms365.teams.activity.user.duration.video
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

- 
JavaScript: `The text is too long. Please see the template.`

|
|Teams: User activity, screen share duration|
The sum of the screen share duration of licensed or non-licensed Microsoft Teams users during the week before the report refresh date.
|Dependent item|ms365.teams.activity.user.duration.screen_share
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

- 
JavaScript: `The text is too long. Please see the template.`

|
|Teams: User activity, post messages|
The number of post messages in all channels made by licensed or non-licensed Microsoft Teams users during the week before the report refresh date. A post is the original message in a teams chat.
|Dependent item|ms365.teams.activity.user.messages.posts
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: User activity, reply messages|
The number of reply messages in all channels made by licensed or non-licensed Microsoft Teams users during the week before the report refresh date.
|Dependent item|ms365.teams.activity.user.messages.replies
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: User count (users), team chat messages|
The number of licensed Microsoft Teams users who posted or replied in team chats during the week before the report refresh date.
|Dependent item|ms365.teams.user_count.users.messages.in_team
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: User count (users), private chat messages|
The number of licensed Microsoft Teams users who posted or replied in private chats during the week before the report refresh date.
|Dependent item|ms365.teams.user_count.users.messages.private
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: User count (users), calls|
The number of licensed Microsoft Teams users who participated in calls during the week before the report refresh date.
|Dependent item|ms365.teams.user_count.users.calls
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: User count (users), meetings|
The number of licensed Microsoft Teams users who participated in meetings during the week before the report refresh date.
|Dependent item|ms365.teams.user_count.users.meetings
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: User count (total), report date|
The date of the report of the number of licensed or non-licensed Microsoft Teams users in activity.
|Dependent item|ms365.teams.user_count.total.report_date
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: User count (total), team chat messages|
The number of licensed or non-licensed Microsoft Teams users who posted or replied in team chats during the week before the report refresh date.
|Dependent item|ms365.teams.user_count.total.messages.in_team
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: User count (total), private chat messages|
The number of licensed or non-licensed Microsoft Teams users who posted or replied in private chats during the week before the report refresh date.
|Dependent item|ms365.teams.user_count.total.messages.private
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: User count (total), calls|
The number of licensed or non-licensed Microsoft Teams users who participated in calls during the week before the report refresh date.
|Dependent item|ms365.teams.user_count.total.calls
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: User count (total), meetings|
The number of licensed or non-licensed Microsoft Teams users who participated in meetings during the week before the report refresh date.
|Dependent item|ms365.teams.user_count.total.meetings
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: User count (guests), team chat messages|
The number of non-licensed Microsoft Teams users (guests) who posted or replied in team chats during the week before the report refresh date.
|Dependent item|ms365.teams.user_count.guests.messages.in_team
**Preprocessing**

- 
JavaScript: `The text is too long. Please see the template.`

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: User count (guests), private chat messages|
The number of non-licensed Microsoft Teams users (guests) who posted or replied in private chats during the week before the report refresh date.
|Dependent item|ms365.teams.user_count.guests.messages.private
**Preprocessing**

- 
JavaScript: `The text is too long. Please see the template.`

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: User count (guests), calls|
The number of non-licensed Microsoft Teams users (guests) who participated in calls during the week before the report refresh date.
|Dependent item|ms365.teams.user_count.guests.calls
**Preprocessing**

- 
JavaScript: `The text is too long. Please see the template.`

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: User count (guests), meetings|
The number of non-licensed Microsoft Teams users (guests) who participated in meetings during the week before the report refresh date.
|Dependent item|ms365.teams.user_count.guests.meetings
**Preprocessing**

- 
JavaScript: `The text is too long. Please see the template.`

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: Team activity, report date|
The date of the report of the number of team activities.
|Dependent item|ms365.teams.activity.team.report_date
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: Team activity, active shared channels|
The number of active shared channels across Microsoft Teams over the week before the report refresh date.
|Dependent item|ms365.teams.activity.team.active_shared_channels
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: Team activity, active external users|
The number of active external users across Microsoft Teams over the week before the report refresh date.
|Dependent item|ms365.teams.activity.team.active_external_users
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: Team activity, active users|
The number of active users across Microsoft Teams over the week before the report refresh date.
|Dependent item|ms365.teams.activity.team.active_users
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: Team activity, active channels|
The number of active channels across Microsoft Teams over the week before the report refresh date.
|Dependent item|ms365.teams.activity.team.active_channels
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: Team activity, channel messages|
The number of channel messages across Microsoft Teams over the week before the report refresh date.
|Dependent item|ms365.teams.activity.team.channel_messages
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: Team activity, guests|
The number of guests across Microsoft Teams over the week before the report refresh date.
|Dependent item|ms365.teams.activity.team.guests
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: Team activity, reactions|
The number of reactions across Microsoft Teams over the week before the report refresh date.
|Dependent item|ms365.teams.activity.team.reactions
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: Team activity, meetings organized|
The number of organized meetings across Microsoft Teams over the week before the report refresh date.
|Dependent item|ms365.teams.activity.team.meetings_organized
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: Team activity, post messages|
The number of post messages across Microsoft Teams over the week before the report refresh date.
|Dependent item|ms365.teams.activity.team.messages.posts
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: Team activity, reply messages|
The number of reply messages across Microsoft Teams over the week before the report refresh date.
|Dependent item|ms365.teams.activity.team.messages.replies
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: Team activity, urgent messages|
The number of urgent messages across Microsoft Teams over the week before the report refresh date.
|Dependent item|ms365.teams.activity.team.urgent_messages
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Teams: Team activity, mentions|
The number of mentions across Microsoft Teams over the week before the report refresh date.
|Dependent item|ms365.teams.activity.team.mentions
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Outlook: Activity, report date|
The date of the Outlook activity count report.
|Dependent item|ms365.outlook.activity.report_date
**Preprocessing**

- 
JSON Path: `$.metrics.getEmailActivityCounts[0].reportRefreshDate`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Outlook: Activity, emails sent|
The number of times an "Email sent" action was recorded.
|Dependent item|ms365.outlook.activity.sent
**Preprocessing**

- 
JSON Path: `$.metrics.getEmailActivityCounts[0].send`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Outlook: Activity, emails received|
The number of times an "Email received" action was recorded.
|Dependent item|ms365.outlook.activity.received
**Preprocessing**

- 
JSON Path: `$.metrics.getEmailActivityCounts[0].receive`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Outlook: Activity, emails read|
The number of times an "Email read" action was recorded.
|Dependent item|ms365.outlook.activity.read
**Preprocessing**

- 
JSON Path: `$.metrics.getEmailActivityCounts[0].read`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Outlook: Activity, meetings created|
The number of times a "Meeting request sent" action was recorded.
|Dependent item|ms365.outlook.activity.meetings_created
**Preprocessing**

- 
JSON Path: `$.metrics.getEmailActivityCounts[0].meetingCreated`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Outlook: Activity, meetings interacted|
The number of times a meeting request accept, tentative, decline, or cancel action was recorded.
|Dependent item|ms365.outlook.activity.meetings_interacted
**Preprocessing**

- 
JSON Path: `$.metrics.getEmailActivityCounts[0].meetingInteracted`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Outlook: User count, report date|
The date of the Outlook activity user count report.
|Dependent item|ms365.outlook.user_count.report_date
**Preprocessing**

- 
JSON Path: `$.metrics.getEmailActivityUserCounts[0].reportRefreshDate`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Outlook: User count, emails sent|
The number of users an "Email sent" action was recorded for.
|Dependent item|ms365.outlook.user_count.sent
**Preprocessing**

- 
JSON Path: `$.metrics.getEmailActivityUserCounts[0].send`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Outlook: User count, emails received|
The number of users an "Email received" action was recorded for.
|Dependent item|ms365.outlook.user_count.received
**Preprocessing**

- 
JSON Path: `$.metrics.getEmailActivityUserCounts[0].receive`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Outlook: User count, emails read|
The number of users an "Email read" action was recorded for.
|Dependent item|ms365.outlook.user_count.read
**Preprocessing**

- 
JSON Path: `$.metrics.getEmailActivityUserCounts[0].read`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Outlook: User count, meetings created|
The number of users a "Meeting request sent" action was recorded for.
|Dependent item|ms365.outlook.user_count.meetings_created
**Preprocessing**

- 
JSON Path: `$.metrics.getEmailActivityUserCounts[0].meetingCreated`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Outlook: User count, meetings interacted|
The number of users a meeting request accept, tentative, decline, or cancel action was recorded for.
|Dependent item|ms365.outlook.user_count.meetings_interacted
**Preprocessing**

- 
JSON Path: `$.metrics.getEmailActivityUserCounts[0].meetingInteracted`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Outlook: User count, app usage, report date|
The date of the report of the unique user count per app.
|Dependent item|ms365.outlook.user_count.report_date.app
**Preprocessing**

- 
JSON Path: `$.metrics.getEmailAppUsageUserCounts[6].reportDate`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Outlook: User count, mail for Mac|
The number of unique users of mail for Mac.
|Dependent item|ms365.outlook.user_count.mail_for_mac
**Preprocessing**

- 
JSON Path: `$.metrics.getEmailAppUsageUserCounts[6].mailForMac`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Outlook: User count, Outlook for Mac|
The number of unique users of Outlook for Mac.
|Dependent item|ms365.outlook.user_count.mac
**Preprocessing**

- 
JSON Path: `$.metrics.getEmailAppUsageUserCounts[6].outlookForMac`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Outlook: User count, Outlook for Windows|
The number of unique users of Outlook for Windows.
|Dependent item|ms365.outlook.user_count.windows
**Preprocessing**

- 
JSON Path: `$.metrics.getEmailAppUsageUserCounts[6].outlookForWindows`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Outlook: User count, Outlook for mobile|
The number of unique users of Outlook for mobile.
|Dependent item|ms365.outlook.user_count.mobile
**Preprocessing**

- 
JSON Path: `$.metrics.getEmailAppUsageUserCounts[6].outlookForMobile`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Outlook: User count, Outlook for web|
The number of unique users of Outlook for web.
|Dependent item|ms365.outlook.user_count.web
**Preprocessing**

- 
JSON Path: `$.metrics.getEmailAppUsageUserCounts[6].outlookForWeb`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Outlook: User count, POP3 applications|
The number of unique users of other POP3 applications.
|Dependent item|ms365.outlook.user_count.pop3app
**Preprocessing**

- 
JSON Path: `$.metrics.getEmailAppUsageUserCounts[6].pop3App`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Outlook: User count, IMAP4 applications|
The number of unique users of other IMAP4 applications.
|Dependent item|ms365.outlook.user_count.imap4app
**Preprocessing**

- 
JSON Path: `$.metrics.getEmailAppUsageUserCounts[6].imap4App`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Outlook: User count, SMTP applications|
The number of unique users of other SMTP applications.
|Dependent item|ms365.outlook.user_count.smtpapp
**Preprocessing**

- 
JSON Path: `$.metrics.getEmailAppUsageUserCounts[6].smtpApp`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Outlook: Mailbox, report date|
The date of the report of the unique user count per app.
|Dependent item|ms365.outlook.mailbox.report_date
**Preprocessing**

- 
JSON Path: `$.metrics.getMailboxUsageMailboxCounts[0].reportDate`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Outlook: Mailbox, total|
The total number of user mailboxes in your organization.
|Dependent item|ms365.outlook.mailbox.total
**Preprocessing**

- 
JSON Path: `$.metrics.getMailboxUsageMailboxCounts[0].total`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Outlook: Mailbox, active|
The number of active user mailboxes in your organization. A mailbox is considered active if the user has sent or read any emails.
|Dependent item|ms365.outlook.mailbox.active
**Preprocessing**

- 
JSON Path: `$.metrics.getMailboxUsageMailboxCounts[0].active`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Outlook: Mailbox, active in %|
Percentage of active user mailboxes in your organization. A mailbox is considered active if the user has sent or read any emails.
|Dependent item|ms365.outlook.mailbox.active.percentage
**Preprocessing**

- 
JavaScript: `The text is too long. Please see the template.`

- 
Discard unchanged with heartbeat: `1d`

|
|Outlook: Mailbox, storage, report date|
The date of the mailbox storage report.
|Dependent item|ms365.outlook.storage.report_date
**Preprocessing**

- 
JSON Path: `$.metrics.getMailboxUsageStorage[0].reportDate`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Outlook: Mailbox, storage used|
The amount of mailbox storage used in your organization.
|Dependent item|ms365.outlook.storage.used
**Preprocessing**

- 
JSON Path: `$.metrics.getMailboxUsageStorage[0].storageUsedInBytes`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|OneDrive: Users, report date|
The date of the report of the number of active OneDrive users.
|Dependent item|ms365.onedrive.users.report_date
**Preprocessing**

- 
JSON Path: `$.metrics.getOneDriveActivityUserCounts[0].reportDate`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|OneDrive: Users, viewed or edited|
The number of users who have viewed or edited OneDrive files.
|Dependent item|ms365.onedrive.users.viewed_or_edited
**Preprocessing**

- 
JSON Path: `$.metrics.getOneDriveActivityUserCounts[0].viewedOrEdited`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|OneDrive: Users, synced|
The number of users who have synced OneDrive files.
|Dependent item|ms365.onedrive.users.synced
**Preprocessing**

- 
JSON Path: `$.metrics.getOneDriveActivityUserCounts[0].synced`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|OneDrive: Users, shared internally|
The number of users who have shared OneDrive files internally.
|Dependent item|ms365.onedrive.users.shared_internally
**Preprocessing**

- 
JSON Path: `$.metrics.getOneDriveActivityUserCounts[0].sharedInternally`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|OneDrive: Users, shared externally|
The number of users who have shared OneDrive files externally.
|Dependent item|ms365.onedrive.users.shared_externally
**Preprocessing**

- 
JSON Path: `$.metrics.getOneDriveActivityUserCounts[0].sharedExternally`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|OneDrive: Files, activity, report date|
The date of report of the number of active OneDrive files.
|Dependent item|ms365.onedrive.files.report_date
**Preprocessing**

- 
JSON Path: `$.metrics.getOneDriveActivityFileCounts[0].reportDate`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|OneDrive: Files, viewed or edited|
The number of viewed or edited OneDrive files.
|Dependent item|ms365.onedrive.files.viewed_or_edited
**Preprocessing**

- 
JSON Path: `$.metrics.getOneDriveActivityFileCounts[0].viewedOrEdited`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|OneDrive: Files, synced|
The number of synced OneDrive files.
|Dependent item|ms365.onedrive.files.synced
**Preprocessing**

- 
JSON Path: `$.metrics.getOneDriveActivityFileCounts[0].synced`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|OneDrive: Files, shared internally|
The number of internally shared OneDrive files.
|Dependent item|ms365.onedrive.files.shared_internally
**Preprocessing**

- 
JSON Path: `$.metrics.getOneDriveActivityFileCounts[0].sharedInternally`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|OneDrive: Files, shared externally|
The number of externally shared OneDrive files.
|Dependent item|ms365.onedrive.files.shared_externally
**Preprocessing**

- 
JSON Path: `$.metrics.getOneDriveActivityFileCounts[0].sharedExternally`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|OneDrive: Business sites, report date|
The date of the number of OneDrive for Business sites report.
|Dependent item|ms365.onedrive.sites.report_date
**Preprocessing**

- 
JSON Path: `$.metrics.getOneDriveUsageAccountCounts[0].reportDate`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|OneDrive: Business sites, total|
The number of OneDrive for Business sites.
|Dependent item|ms365.onedrive.sites.total
**Preprocessing**

- 
JSON Path: `$.metrics.getOneDriveUsageAccountCounts[0].total`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|OneDrive: Business sites, active|
The number of active OneDrive for Business sites. Any site on which users have viewed, modified, uploaded, downloaded, shared, or synced files is considered an active site.
|Dependent item|ms365.onedrive.sites.active
**Preprocessing**

- 
JSON Path: `$.metrics.getOneDriveUsageAccountCounts[0].active`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|OneDrive: File count, report date|
The date of the OneDrive file count report.
|Dependent item|ms365.onedrive.file_count.report_date
**Preprocessing**

- 
JSON Path: `$.metrics.getOneDriveUsageFileCounts[0].reportDate`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|OneDrive: File count, total|
The total number of files across all sites.
|Dependent item|ms365.onedrive.file_count.total
**Preprocessing**

- 
JSON Path: `$.metrics.getOneDriveUsageFileCounts[0].total`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|OneDrive: File count, active|
The total number of active files across all sites. A file is considered active if it has been saved, synced, modified, or shared.
|Dependent item|ms365.onedrive.file_count.active
**Preprocessing**

- 
JSON Path: `$.metrics.getOneDriveUsageFileCounts[0].active`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|OneDrive: Storage, report date|
The date of the report of the amount of storage used in OneDrive for Business.
|Dependent item|ms365.onedrive.storage.report_date
**Preprocessing**

- 
JSON Path: `$.metrics.getOneDriveUsageStorage[0].reportDate`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|OneDrive: Storage, total|
The total amount of storage used in OneDrive for Business.
|Dependent item|ms365.onedrive.storage.total
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|SharePoint: Files, activity, report date|
The date of the report of the number of active SharePoint files.
|Dependent item|ms365.sharepoint.files.report_date
**Preprocessing**

- 
JSON Path: `$.metrics.getSharePointActivityFileCounts[0].reportDate`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|SharePoint: Files, viewed or edited|
The number of viewed or edited SharePoint files.
|Dependent item|ms365.sharepoint.files.viewed_or_edited
**Preprocessing**

- 
JSON Path: `$.metrics.getSharePointActivityFileCounts[0].viewedOrEdited`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|SharePoint: Files, synced|
The number of files synced to a SharePoint site.
|Dependent item|ms365.sharepoint.files.synced
**Preprocessing**

- 
JSON Path: `$.metrics.getSharePointActivityFileCounts[0].synced`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|SharePoint: Files, shared internally|
The number of internally shared SharePoint files.
|Dependent item|ms365.sharepoint.files.shared_internally
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|SharePoint: Files, shared externally|
The number of externally shared SharePoint files.
|Dependent item|ms365.sharepoint.files.shared_externally
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|SharePoint: Users, report date|
The date of the report of the number of active SharePoint users.
|Dependent item|ms365.sharepoint.user_count.report_date
**Preprocessing**

- 
JSON Path: `$.metrics.getSharePointActivityUserCounts[0].reportDate`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|SharePoint: Users, viewed or edited|
The number of users who have viewed or edited SharePoint files.
|Dependent item|ms365.sharepoint.user_count.viewed_or_edited
**Preprocessing**

- 
JSON Path: `$.metrics.getSharePointActivityUserCounts[0].viewedOrEdited`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|SharePoint: Users, synced|
The number of users who have synced SharePoint files.
|Dependent item|ms365.sharepoint.user_count.synced
**Preprocessing**

- 
JSON Path: `$.metrics.getSharePointActivityUserCounts[0].synced`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|SharePoint: Users, shared internally|
The number of users who have shared SharePoint files internally.
|Dependent item|ms365.sharepoint.user_count.shared_internally
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|SharePoint: Users, shared externally|
The number of users who have shared SharePoint files externally.
|Dependent item|ms365.sharepoint.user_count.shared_externally
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|SharePoint: Users, pages visited|
The number of users who have visited unique pages.
|Dependent item|ms365.sharepoint.user_count.visited_page
**Preprocessing**

- 
JSON Path: `$.metrics.getSharePointActivityUserCounts[0].visitedPage`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|SharePoint: Pages, visited, report date|
The date of the report of the number of pages visited.
|Dependent item|ms365.sharepoint.pages_visited.report_date
**Preprocessing**

- 
JSON Path: `$.metrics.getSharePointActivityPages[0].reportDate`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|SharePoint: Pages, visited|
The number of unique pages visited by users.
|Dependent item|ms365.sharepoint.pages_visited.count
**Preprocessing**

- 
JSON Path: `$.metrics.getSharePointActivityPages[0].visitedPageCount`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|SharePoint: File count, report date|
The date of the SharePoint file count report.
|Dependent item|ms365.sharepoint.file_count.report_date
**Preprocessing**

- 
JSON Path: `$.metrics.getSharePointSiteUsageFileCounts[0].reportDate`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|SharePoint: File count, total|
The total number of files across all sites.
|Dependent item|ms365.sharepoint.file_count.total
**Preprocessing**

- 
JSON Path: `$.metrics.getSharePointSiteUsageFileCounts[0].total`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|SharePoint: File count, active|
The total number of active files across all sites. A file is considered active if it has been saved, synced, modified, or shared.
|Dependent item|ms365.sharepoint.file_count.active
**Preprocessing**

- 
JSON Path: `$.metrics.getSharePointSiteUsageFileCounts[0].active`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|SharePoint: Sites, report date|
The date of the report of the number of SharePoint sites.
|Dependent item|ms365.sharepoint.site.report_date
**Preprocessing**

- 
JSON Path: `$.metrics.getSharePointSiteUsageSiteCounts[0].reportDate`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|SharePoint: Sites, total|
The number of SharePoint sites.
|Dependent item|ms365.sharepoint.sites.total
**Preprocessing**

- 
JSON Path: `$.metrics.getSharePointSiteUsageSiteCounts[0].total`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|SharePoint: Sites, active|
The number of active SharePoint sites.
|Dependent item|ms365.sharepoint.sites.active
**Preprocessing**

- 
JSON Path: `$.metrics.getSharePointSiteUsageSiteCounts[0].active`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|SharePoint: Storage, report date|
The date of the report of the amount of storage used in SharePoint.
|Dependent item|ms365.sharepoint.storage.report_date
**Preprocessing**

- 
JSON Path: `$.metrics.getSharePointSiteUsageStorage[0].reportDate`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|SharePoint: Storage, total|
The total amount of storage used in SharePoint.
|Dependent item|ms365.sharepoint.storage.total
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|SharePoint: Pages, viewed, report date|
The date of the report of the number of pages viewed.
|Dependent item|ms365.sharepoint.pages_viewed.report_date
**Preprocessing**

- 
JSON Path: `$.metrics.getSharePointSiteUsagePages[0].reportDate`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|SharePoint: Pages, view count|
The number of pages viewed across all sites.
|Dependent item|ms365.sharepoint.pages_viewed.count
**Preprocessing**

- 
JSON Path: `$.metrics.getSharePointSiteUsagePages[0].pageViewCount`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Apps: Users, report date|
The date of the active user count report.
|Dependent item|ms365.apps.users.report_date
**Preprocessing**

- 
JSON Path: `$.metrics.getOffice365ActiveUserCounts[6].reportDate`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Apps: Users, Office 365|
The number of daily Office 365 users.
|Dependent item|ms365.apps.users.office365
**Preprocessing**

- 
JSON Path: `$.metrics.getOffice365ActiveUserCounts[6].office365`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Apps: Users, Exchange|
The number of daily Exchange users.
|Dependent item|ms365.apps.users.exchange
**Preprocessing**

- 
JSON Path: `$.metrics.getOffice365ActiveUserCounts[6].exchange`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Apps: Users, OneDrive|
The number of daily OneDrive users.
|Dependent item|ms365.apps.users.onedrive
**Preprocessing**

- 
JSON Path: `$.metrics.getOffice365ActiveUserCounts[6].oneDrive`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Apps: Users, SharePoint|
The number of daily SharePoint users.
|Dependent item|ms365.apps.users.sharepoint
**Preprocessing**

- 
JSON Path: `$.metrics.getOffice365ActiveUserCounts[6].sharePoint`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Apps: Users, Skype for Business|
The number of daily Skype for Business users.
|Dependent item|ms365.apps.users.skype
**Preprocessing**

- 
JSON Path: `$.metrics.getOffice365ActiveUserCounts[6].skypeForBusiness`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Apps: Users, Yammer|
The number of daily Yammer users.
|Dependent item|ms365.apps.users.yammer
**Preprocessing**

- 
JSON Path: `$.metrics.getOffice365ActiveUserCounts[6].yammer`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Apps: Users, Teams|
The number of daily Teams users.
|Dependent item|ms365.apps.users.teams
**Preprocessing**

- 
JSON Path: `$.metrics.getOffice365ActiveUserCounts[6].teams`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Apps: Activity, report date|
The date of the report of the user count by activity.
|Dependent item|ms365.apps.activity.report_date
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Apps: Activity, Exchange active users|
The number of active Exchange users during the week before the report date.
|Dependent item|ms365.apps.activity.exchange.users.active
**Preprocessing**

- 
JSON Path: `$.metrics.getOffice365ServicesUserCounts[0].exchangeActive`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Apps: Activity, Exchange inactive users|
The number of inactive Exchange users during the week before the report date.
|Dependent item|ms365.apps.activity.exchange.users.inactive
**Preprocessing**

- 
JSON Path: `$.metrics.getOffice365ServicesUserCounts[0].exchangeInactive`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Apps: Activity, OneDrive active users|
The number of active OneDrive users during the week before the report date.
|Dependent item|ms365.apps.activity.onedrive.users.active
**Preprocessing**

- 
JSON Path: `$.metrics.getOffice365ServicesUserCounts[0].oneDriveActive`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Apps: Activity, OneDrive inactive users|
The number of inactive OneDrive users during the week before the report date.
|Dependent item|ms365.apps.activity.onedrive.users.inactive
**Preprocessing**

- 
JSON Path: `$.metrics.getOffice365ServicesUserCounts[0].oneDriveInactive`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Apps: Activity, SharePoint active users|
The number of active SharePoint users during the week before the report date.
|Dependent item|ms365.apps.activity.sharepoint.users.active
**Preprocessing**

- 
JSON Path: `$.metrics.getOffice365ServicesUserCounts[0].sharePointActive`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Apps: Activity, SharePoint inactive users|
The number of inactive SharePoint users during the week before the report date.
|Dependent item|ms365.apps.activity.sharepoint.users.inactive
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Apps: Activity, Skype for Business active users|
The number of active Skype for Business users during the week before the report date.
|Dependent item|ms365.apps.activity.skypeforbusiness.users.active
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Apps: Activity, Skype for Business inactive users|
The number of inactive Skype for Business users during the week before the report date.
|Dependent item|ms365.apps.activity.skypeforbusiness.users.inactive
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Apps: Activity, Yammer active users|
The number of active Yammer users during the week before the report date.
|Dependent item|ms365.apps.activity.yammer.users.active
**Preprocessing**

- 
JSON Path: `$.metrics.getOffice365ServicesUserCounts[0].yammerActive`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Apps: Activity, Yammer inactive users|
The number of inactive Yammer users during the week before the report date.
|Dependent item|ms365.apps.activity.yammer.users.inactive
**Preprocessing**

- 
JSON Path: `$.metrics.getOffice365ServicesUserCounts[0].yammerInactive`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Apps: Activity, Teams active users|
The number of active Teams users during the week before the report date.
|Dependent item|ms365.apps.activity.teams.users.active
**Preprocessing**

- 
JSON Path: `$.metrics.getOffice365ServicesUserCounts[0].teamsActive`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Apps: Activity, Teams inactive users|
The number of inactive Teams users during the week before the report date.
|Dependent item|ms365.apps.activity.teams.users.inactive
**Preprocessing**

- 
JSON Path: `$.metrics.getOffice365ServicesUserCounts[0].teamsInactive`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Apps: Activity, Office 365 active users|
The number of active Office 365 users during the week before the report date.
|Dependent item|ms365.apps.activity.office365.users.active
**Preprocessing**

- 
JSON Path: `$.metrics.getOffice365ServicesUserCounts[0].office365Active`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Apps: Activity, Office 365 inactive users|
The number of inactive Office 365 users during the week before the report date.
|Dependent item|ms365.apps.activity.office365.users.inactive
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Apps: Office, user count report date|
The date of the report of the number of active users for each app.
|Dependent item|ms365.apps.office.user_count.report_date
**Preprocessing**

- 
JSON Path: `$.metrics.getM365AppUserCounts[0].userCounts[0].reportDate`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Apps: Office, Outlook user count|
The number of active Outlook users.
|Dependent item|ms365.apps.office.user_count.outlook
**Preprocessing**

- 
JSON Path: `$.metrics.getM365AppUserCounts[0].userCounts[0].outlook`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Apps: Office, Word user count|
The number of active Word users.
|Dependent item|ms365.apps.office.user_count.word
**Preprocessing**

- 
JSON Path: `$.metrics.getM365AppUserCounts[0].userCounts[0].word`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Apps: Office, Excel user count|
The number of active Excel users.
|Dependent item|ms365.apps.office.user_count.excel
**Preprocessing**

- 
JSON Path: `$.metrics.getM365AppUserCounts[0].userCounts[0].excel`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Apps: Office, PowerPoint user count|
The number of active PowerPoint users.
|Dependent item|ms365.apps.office.user_count.powerpoint
**Preprocessing**

- 
JSON Path: `$.metrics.getM365AppUserCounts[0].userCounts[0].powerPoint`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Apps: Office, OneNote user count|
The number of active OneNote users.
|Dependent item|ms365.apps.office.user_count.onenote
**Preprocessing**

- 
JSON Path: `$.metrics.getM365AppUserCounts[0].userCounts[0].oneNote`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Apps: Office, Teams user count|
The number of active Teams users.
|Dependent item|ms365.apps.office.user_count.teams
**Preprocessing**

- 
JSON Path: `$.metrics.getM365AppUserCounts[0].userCounts[0].teams`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Apps: Platform, user count report date|
The date of the report of the number of active users per platform.
|Dependent item|ms365.apps.platform.user_count.report_date
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Apps: Platform, Windows user count|
The number of active users on the Windows platform.
|Dependent item|ms365.apps.platform.user_count.windows
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Apps: Platform, Mac user count|
The number of active users on the Mac platform.
|Dependent item|ms365.apps.platform.user_count.mac
**Preprocessing**

- 
JSON Path: `$.metrics.getM365AppPlatformUserCounts[0].userCounts[0].mac`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Apps: Platform, mobile user count|
The number of active users on the mobile platform.
|Dependent item|ms365.apps.platform.user_count.mobile
**Preprocessing**

- 
JSON Path: `The text is too long. Please see the template.`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|
|Apps: Platform, web user count|
The number of active users on the web platform.
|Dependent item|ms365.apps.platform.user_count.web
**Preprocessing**

- 
JSON Path: `$.metrics.getM365AppPlatformUserCounts[0].userCounts[0].web`

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1d`

|

### Triggers

|Name|Description|Expression|Severity|Dependencies and additional info|
|----|-----------|----------|--------|--------------------------------|
|Microsoft 365: Services: There are errors in requests to API|
Zabbix has received errors in response to API requests.
|`length(last(/Microsoft 365 reports by HTTP/ms365.services.errors))>0`|Average||
|Microsoft 365: Teams: There are errors in requests to API|
Zabbix has received errors in response to API requests.
|`length(last(/Microsoft 365 reports by HTTP/ms365.teams.errors))>0`|Average||
|Microsoft 365: Outlook: There are errors in requests to API|
Zabbix has received errors in response to API requests.
|`length(last(/Microsoft 365 reports by HTTP/ms365.outlook.errors))>0`|Average||
|Microsoft 365: OneDrive: There are errors in requests to API|
Zabbix has received errors in response to API requests.
|`length(last(/Microsoft 365 reports by HTTP/ms365.onedrive.errors))>0`|Average||
|Microsoft 365: SharePoint: There are errors in requests to API|
Zabbix has received errors in response to API requests.
|`length(last(/Microsoft 365 reports by HTTP/ms365.sharepoint.errors))>0`|Average||
|Microsoft 365: Apps: There are errors in requests to API|
Zabbix has received errors in response to API requests.
|`length(last(/Microsoft 365 reports by HTTP/ms365.apps.errors))>0`|Average||

### LLD rule Microsoft cloud service discovery

|Name|Description|Type|Key and additional info|
|----|-----------|----|-----------------------|
|Microsoft cloud service discovery|
The list of Microsoft cloud services subscribed by a tenant.
|Dependent item|ms365.service.discovery
**Preprocessing**

- 
JSON Path: `$.services.value`

- 
Discard unchanged with heartbeat: `6h`

|

### Item prototypes for Microsoft cloud service discovery

|Name|Description|Type|Key and additional info|
|----|-----------|----|-----------------------|
|Services: {#NAME} health status|
Overall service health status of `[{#NAME}]`.

More information about health status values can be found here:

https://learn.microsoft.com/en-us/graph/api/resources/servicehealthissue?view=graph-rest-beta#servicehealthstatus-values
|Dependent item|ms365.service.health[{#NAME}]
**Preprocessing**

- 
JSON Path: `$.services.value[?(@.service == '{#NAME}')].status.first()`

- 
JavaScript: `The text is too long. Please see the template.`

- 
Discard unchanged with heartbeat: `1d`

|

### Trigger prototypes for Microsoft cloud service discovery

|Name|Description|Expression|Severity|Dependencies and additional info|
|----|-----------|----------|--------|--------------------------------|
|Microsoft 365: Services: {#NAME} is degraded.|
The service has the "Degraded" health status.
An issue is confirmed that may affect the use of a service or feature. You might see this status if a service is performing slower than usual, there are intermittent interruptions, or if a feature isn't working.
|`last(/Microsoft 365 reports by HTTP/ms365.service.health[{#NAME}])=6`|Warning|**Manual close**: Yes|
|Microsoft 365: Services: {#NAME} is interrupted.|
The service has the "Interruption" health status.
An issue was determined that affects users being able to access the service. In this case, the issue is significant and can be reproduced consistently.
|`last(/Microsoft 365 reports by HTTP/ms365.service.health[{#NAME}])=7`|Average|**Manual close**: Yes|

## Feedback

Please report any issues with the template at [`https://support.zabbix.com`](https://support.zabbix.com)

You can also provide feedback, discuss the template, or ask for help at [`ZABBIX forums`](https://www.zabbix.com/forum/zabbix-suggestions-and-feedback)

