If you're experiencing discrepancies in the active/inactive users (license usage) data in CoreView, this guide will help you troubleshoot the issue.
Problem
CoreView relies on various sources like PowerShell, Exchange Web Services, Graph, Management API, and Azure AD Audit. However, data from these sources may not always synchronize perfectly, resulting in reporting differences. These factors can cause reporting discrepancies:
- Data latency: CoreView data has a latency of up to 72 hours, causing a delay in reflecting user activity changes in reports and active/inactive status updates. For more information, refer to the article on understanding data import.
- Missing data: Tenant configuration or restrictions can lead to missing data points, affecting the accuracy of active/inactive user status in CoreView.
Solution
Step 1: check if anonymous reporting is enabled
On your tenant, this scrambles all data and makes usage stats impossible to retrieve.
Xstats data are still available in many places on Microsoft Portal like: Teams Admin Center, Exchange Admin Center, Azure AD Admin Center.
- Connect to “Microsoft Admin Center“ > “Settings” > “Org Settings” > “Reports”
- Verify that the settings are as shown in the picture below:
Step 2: check Exchange activity
“Exchange Last Date” is a complex matter on Microsoft's side as it is continually revised. Now, the most precise information is retrieved from Graph and is available in the:
Exchange Activity report in CoreView
This date is updated by Microsoft if there are “Mail read” or “Mail sent” activities within the selected date range. This data is retrieved from the Graph API. More information is available within Microsoft's documentation.
“Last activity date” refers to the most recent time when the user performed a read or send email activity. It is mapped to the field “Last Exchange User Action Date”. More information is available within Microsoft's documentation.
It is possible that a user's “Disabled (Blocked Credentials)” status is marked as active in CoreView, indicating that another user is accessing their resources, usually usually Mailboxes and OneDrive.
For users who do not have an Azure AD Logon but have a “Last Exchange” user interaction date, it could indicate that someone sent an email on behalf of the mailbox, which triggered the activity. To confirm this, you can check the “Mail Traffic” report by the user and apply relevant filters.
Step 3: check Teams activity
Teams Activity is retrieved from:
Teams Users Activity report in CoreView
This date is updated by Microsoft if there is any user interaction with Teams. It is mapped to the field “Teams Last Activity Date”. Last Activity Date (UTC) refers to the most recent date on which the user participated in a Microsoft Teams activity.
Channel messages represent the number of unique messages that the user posted in a team chat during the specified time period.
More information is available within Microsoft's documentation.
Opening client is not considered an activity.
Step 4: check OneDrive activity
OneDrive Activity is retrieved from:
OneDrive Activity report in CoreView
This date is updated by Microsoft if there is any user interaction with OneDrive. This is mapped on the field “Last OneDrive Logon”. It represents the latest date a file activity was performed on the OneDrive account for the selected date range. To view activity that occurred on a specific date, simply select the desired date directly from the chart.
More information is available within Microsoft's documentation.
Step 5: check SharePoint activity
SharePoint Activity is retrieved from:
SharePoint Activity report in CoreView
This date is updated by Microsoft if there is any user interaction with SharePoint. This is mapped on the field “SharePoint Last Action”. It represents the latest date when a file activity was performed or a page was visited within the selected date range. To view activity that occurred on a specific date, simply select the desired date directly from the chart.
More information is available within Microsoft's documentation.
Step 6: check Power BI Pro activity
Power BI Pro activity is not tracked by Microsoft in standard API/Reports. Instead, we combine multiple sources of information to determine the last time a user with a Power BI Pro license has engaged in any activity on Power BI. The detailed list of these sources is available within Microsoft's documentation. This date is mapped to the field “PowerBI Last Action”.
Step 7: check Dynamics 365 activity
Dynamics 365 activity is not tracked by Microsoft in standard API/Reports. Instead, we combine multiple sources of information to capture the last time a user with a Dynamics license has engaged in any activity on Dynamics. This date is mapped to the field “Crm Last Activity Date”.
Dynamics 365 must be configured to send audits to the Microsoft Unified Audit Logs for this tracking to work.
Step 8: check Skype activity
Skype Activity is retrieved from:
Skype Activity report in CoreView
This date is updated by Microsoft if there is any user interaction with Skype. It is mapped to the field “Skype Last Logon”, indicating the most recent time when the user engaged in a peer-to-peer session, organized a conference, or participated in a conference.
More information is available within Microsoft's documentation.
Opening client is not considered an activity.
Step 9: check Yammer activity
Yammer Activity is retrieved from:
Yammer Activity report in CoreView
This date is updated by Microsoft if there is any user interaction with Yammer. It is mapped to the field “Yammer Last Activity Date”, indicating the last date when the user posted, read, or liked a message.
More information available within Microsoft's documentation.
Step 10: check Microsoft365 activity
“Last M365 Activity Date” refers to the maximum date among all tracked activity dates, including:
- LastExUserActionTime
- OneDriveLastAction
- YammerLastActivityDate
- CrmLastActivityDate
- LyncLastActivityTime
- TeamsLastActivityDate
- PowerBILastAction
- SharePointLastAction
- M365ClientAppLastActivityDate
Last Azure AD Logon is not considered, as it pertains to identity, which is a basic service covered by free licenses. Logon does not necessarily indicate usage.