Troubleshoot Active Users (License Usage) data
Modified on Wed, 29 Mar 2023 at 09:22 AM
Categories
-
What's New
-
Release Information
- CoreView Release Notes September 2023
- CoreView Release Notes August 2023
- CoreView Release Notes July 2023
- CoreView Release Notes June 2023
- CoreView Release Notes May 2023
- CoreView Release Notes April 2023
- CoreView Release Notes March 2023
- CoreView Release Notes February 2023
- CoreView Release Notes January 2023
- CoreView December 2022 Release Notes
- CoreView November 2022 Release Notes
- CoreView October 2022 Release Notes
- September 2022 Release Notes
- August 2022 Release Notes
- Release 22.06 Key Features
- Release 22.05 Key Features
- Release 22.04 Key Features
- Release 22.03 Key Features
- Release 22.01 Key Features
- Release 21.12 Key Features
- Release 21.11 Key Features
- Release 21.10 Key Features
- Release 21.09 Key Features
- Release 21.08 Key Features
- Release 21.07 Key Features
- Release 21.05 Key Features
- Release 21.04 Key Features
- Release 21.03 Key Features
- Release 21.02 Key Features
- Release 21.01 Key Features
-
Release Information
- Getting Started with Customer Care
-
Getting Started with CoreView
-
Configuring
- Configuration Overview
- Creating CoreView Tenant Administrators
- CoreView Operator Uses Cases & Dependencies
- Creating a License Pool
- Understanding Virtual Tenants
- "Send As" DNS Requirements for CoreAdoption Campaigns (Optional)
- How to enforce MFA on CoreView service accounts
- Creating a License Pool
- How to ensure security for CoreView service accounts
- Disabling MFA for CoreView service accounts
- Set Conditional Access to grant access only inside the CoreView data center
-
Configuring
-
How to
-
Exchange Online
- How to check and analyze the Message Trace
- How To Configure Email Forwarding
- How to convert a Shared Mailbox to a User Mailbox
- How to convert a user mailbox to a shared mailbox in Exchange Online
- How to Create Microsoft 365 Groups for Improved Collaboration
- How To Create Shared Mailbox
- How To Create User Mailbox
- How To Grant Access To Mailbox
- How to List all the Mailboxes a User has access to in Microsoft 365
- How to remove delegates from Mailbox
- How to remove user access to Mailbox
- How to review and manage Exchange online mailbox permissions
- How to verify if a user has updated the Password
- Read Permission for Mailbox
- What are security groups and How to create it
- What is a Distribution Group and How to create it
-
Exchange Online
- Custom Actions Library
- Getting Started with CoreHybrid
-
Knowledge Resources
-
Understanding CoreView - Quick Start Guides.
- CoreView Quick Start Guide Overview and Index - Tenant Admins
- CoreView Quick Start Guide Overview and Index - Operators
- Understanding CoreView Tenant Configuration – Management
- Understanding the CoreView Operator Profile
- Understanding CoreView Operator Roles (New UX)
- Understanding CoreView Operator Roles
- Understanding CoreView Operator Delegation
- Understanding CoreView - Report Column Filtering
- Understanding CoreView Tenant Configuration - V-Tenant User Filters
- Understanding CoreView Tenant Configuration - Portal Information
- Understanding CoreView Tenant Configuration Options
-
Troubleshooting Common Issues
- Unable to see OneDrive, SharePoint and Exchange Data
- Remote Office 365 PowerShell session can Conflict CoreView Management Actions
- Why I cannot save the changes on existing License pool?
- Error when attempting to perform a Management Action
- Unable to modify the Assigned Licenses in my License Pool Report
- Enabling Permission for Endpoint Manager Actions
- How to enable permission for BitLocker keys report
-
Tenant Administration
- How to recreate Admins Read-only
- How to add an operator to the portal?
- How to enable and configure CoreView management session
- How to provide a consent to activate Azure AD Reports Feature and activate Partial Import?
- Tips & Tricks: Leverage Pivot Reports to Prototype License Pool Criteria Filter
- Tips & Tricks - How to manage email notifications for newly added Operators.
- Disable MFA from Read Only Service Accounts
- How To: Report on "Consumed Portal Licenses"
- How to Configure Allowed IP Addresses for CoreView Service Accounts
- Tips & Tricks: How to merge License Pools
- How to Use CoreView's Global Report Filters
- How to use the What If tool to check Azure AD conditional access policies
- How to Configure Allowed IP Addresses for CoreView Service Accounts
- How to Archive a Teams Group
- How to Restore a Teams Group
- On-demand Import for a Single Device in Endpoint Manager (Intune)
- Custom Actions using the Microsoft Graph API
- How to set up your tenant for the switch to Microsoft Graph API
- GraphAPI configuration: How to get Client ID and Client Secret
- How to provide consent to import exchange information
-
Reporting and Analytics
- How do I Check and Manage Calendar Permissions for a User?
- How CoreView can help you with your Microsoft 365 Chargeback Goals.
- New UX: Understanding the new License Centers
- Understanding the Savings Opportunities Dashboard
- Understanding the License Optimization center
- Understanding License Pool Snapshots report
- Understanding Call quality dashboard
- Understanding Call quality report
- Understanding User call quality report
- Understanding Teams groups activity report
- Understanding Teams Adoption Growth Report
- Understanding Endpoint Manager reports
- Understanding Teams dashboard
- Understanding Risky Users report
- Understanding Storage Dashboard
- Troubleshoot Active Users (License Usage) data
- Legacy Protocol Management
- Report Columns: Is active 30/60/90
- Quarantined Messages Report - Understanding The Reports
-
Managing and Administration
- Teams Voice: Direct Routing Support
- How to enable management function?
- Forward SMTP Address vs Forward Address management actions
- How to add the users in bulk while executing Users management actions?
- How to Create & Manage Custom Actions
- How to schedule a report to be sent automatically, and how to modify its scheduling options?
- How to schedule an alert report for the License Count
- Tips & Tricks – How to read and modify license pool report?
- Overview of CoreView Workflow
- How to delegate Workflow management using roles
- How to configure CoreView and ServiceNow integration
- How to Enable Multi Factor Authentication for Operators and Admins who Access the CoreView Portal
- How Can I Migrate from Group-Based Licenses to Direct Licenses Managed by CoreView?
- Naming convention rules
- Custom Actions: Forbidden and Warning Values
- How to add users to Distribution Group in bulk using via CSV
- Not able to manage licenses error
- Using custom action json output as an input in the workflow
- Setting the Sensitivity Label on SharePoint as a Mandatory Field
- DistinguishedName vs OnPremisesDistinguishedName
-
Understanding CoreView - Quick Start Guides.
- CoreView Product Manual
- Health Check
- Actions
-
Playbooks
-
Out-of-the-Box playbooks
- Introduction
- Overview
- Configuring predefined policies
- Edit policy settings: Set and monitor thresholds
- Edit remediation settings: Manual and automatic remediation
- Edit remediation settings: Configure attestation
- Remediation settings: Security & Identity policies
- Remediation settings: Teams Management policies
- Remediation settings: License Management policies
- Remediation settings: SharePoint & OneDrive Management policies
- Remediation settings: Exchange Management policies
-
Out-of-the-Box playbooks
- Workflows
- Learning Platform
- Internal Customer Care Resources
- Archive
- PowerShell
- Webinars and Events
- CoreVoice
- Internal Support
Issue: Active/Inactive users on CoreView seems wrong
CoreView relies on multiple sources of data from PowerShell, Exchange Web Services, Graph, Management API, Azure AD Audit, just to name a few.
Data retrieved can have various latency (up to 72 hours) and some can be completely missing due to tenant configuration/restrictions.
Solution:
Here is step-by-step guide to troubleshoot the problem:
1. Check if anonymous report is enabled On your tenant, this scrambles all data and makes usage stats impossible to retrieve. (xtats data are still available in clear in many places on Microsoft Portal like: Teams Admin Center, Exchange Admin Center, Azure AD Admin Center.
Connect to Microsoft Admin Center - Settings - Org Settings – Reports
Verify that settings like in the picture below:
2. Check Exchange Activity
Exchange Last Date is a complex matter on the Microsoft side, it is revised continually. Now the most precise information is retrieved from Graph and it's available in the Exchange Activity Report:
https://portal.coreview.com/Admin/20210104132649/#/exchangeReports/ExchangeEmailActivity
This date is updated by Microsoft if there are Mail Read or Mail Sent in the selected date range.
This data are retrieved from Graph API: https://docs.microsoft.com/en-us/graph/api/reportroot-getemailactivityuserdetail?view=graph-rest-1.0#response
Last activity date refers to the last time the user performed a read or send email activity. It is mapped on the field Last Exchange User Action Date.
Note: it can happen that a User’s Disabled (Blocked Credentials) are marked as active in CoreView, this means that another user is accessing their resources (mainly happening for Mailboxes, OneDrive)
For users who do not have an Azure AD Logon but have a Last Exchange user interaction date, it could indicate that someone sent an email on behalf of the mailbox, which triggered the activity. To confirm this, you can check the Mail Traffic report by the user and filter it accordingly.
3. Check Teams Activity
Teams Activity is retrieved from Teams Users Activity Report:
This date is updated by Microsoft if there is any user interaction with Teams
This is mapped on the field Teams Last Activity Date
Last Activity Date (UTC) refers to the last date that the user participated in a Microsoft Teams activity.
Channel messages is the number of unique messages that the user posted in a team chat during the specified time period.
Note: opening client is not considered activity.
4. Check OneDrive Activity
OneDrive Activity is retrieved from OneDrive Activity Report https://portal.coreview.com/Admin/20210126124053/#/OneDriveReports/oneDriveActivity
This date is updated by Microsoft if there is any user interaction with OneDrive
This is mapped on the field Last OneDrive Logon
The latest date a file activity was performed on the OneDrive account for the selected date range. To see activity that occurred on a specific date, select the date directly in the chart.
5. Check SharePoint Activity
SharePoint Activity is retrieved from SharePoint Activity Report https://portal.coreview.com/Admin/20210126124053/#/sharepointReports/sharepointActivity
This date is updated by Microsoft if there is any user interaction with SharePoint
This is mapped on the field SharePoint Last Action
The latest date a file activity was performed or a page was visited for the selected date range. To see activity that occurred on a specific date, select the date directly in the chart.
6. Check Power BI Pro Activity
Power BI Pro activity is not tracked by Microsoft in standard API / Reports. We are combining multiple sources of info to get last time a user with a Power BI Pro license has done any activity on Power BI (Here detailed list: https://docs.microsoft.com/en-us/power-bi/admin/service-admin-auditing)
This date is mapped on the field PowerBI Last Action
7. Check Dynamics 365 Activity
Dynamics 365 activity is not tracked by Microsoft in standard API / Reports. We are combining multiple sources of info to get last time a user with a Dynamic license has done any activity on Dynamics
This date is mapped on the field Crm Last Activity Date
Note: Dynamics 365 must be configured to send audit to Microsoft Unified Log for this tracking to work
8. Check Skype Activity
Skype Activity is retrieved from Skype Activity Report https://portal.coreview.com/Admin/20210126124053/#/skypeReports/skypeActivity
This date is updated by Microsoft if there is any user interaction with Skype
This is mapped on the field Skype Last Logon
the latest time the user engaged in a peer to peer session, or organized a conference or participated in a conference.
Note: opening client is not considered activity.
9. Check Yammer Activity
Yammer Activity is retrieved from Yammer Activity Report https://portal.coreview.com/Admin/20210126124053/#/yammerReports/yammerActivity
This date is updated by Microsoft if there is any user interaction with Yammer
This is mapped on the field Yammer Last Activity Date
The last date that the user posted, read, or liked a message.
10. Check M365 Activity
'Last M365 Activity Date' refers to the max date between all activity dates tracked:
- LastExUserActionTime,
- OneDriveLastAction,
- YammerLastActivityDate,
- CrmLastActivityDate,
- LyncLastActivityTime,
- TeamsLastActivityDate,
- PowerBILastAction,
- SharePointLastAction,
- M365ClientAppLastActivityDate
Note: Last Azure AD Logon is not considered, because identity is a basic service covered by free licenses. Logon does not mean usage of