'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Fix No Activity Data in Microsoft Defender for Cloud Apps
Question details
The user is unable to see detailed cloud activity events in the Microsoft Defender for Cloud Apps dashboard, despite having a connected Microsoft 365 App connector.
- Product
- Microsoft Defender for Cloud Apps
- Device & OS
- not provided
- Scenario
- Monitoring security events and detailed cloud activity logs for Microsoft 365 services.
- Observed behavior
- The dashboard displays no activity data due to potential status errors, missing permissions, or incorrect connector configurations, such as only having the Azure AD connector enabled.
Ensure you have global administrator or security administrator privileges in the Microsoft Defender portal before attempting to modify app connector settings.
Configure and Verify the Microsoft 365 App Connector
Check the status of your Microsoft 365 App connector, resolve any permission errors, and ensure it is fully enabled to ingest detailed cloud activity events.
A connected Microsoft 365 App connector does not automatically guarantee that detailed cloud activity events are being ingested. The connector must be explicitly configured and free of status errors. If only the Azure AD users and groups connector is enabled, you will not receive detailed cloud app event logs.
Log in to the Microsoft Defender portal, navigate to the Settings menu, and select App Connectors.
Locate Microsoft 365 in your list of connected apps and open its configuration settings according to official connector documentation.
Check if the connector displays any status errors. Ensure that the specific Microsoft 365 App connector is enabled, rather than just the Azure AD users and groups connector.
Confirm that all required API permissions are granted and that the correct Microsoft 365 users and services are selected for protection.
Allow sufficient time for the events to sync from Microsoft 365 to Defender. Afterward, check the Activity log and reports to verify that data ingestion is successful.
Simplify Your Document Workflow with WPS Office
While enterprise security tools like Microsoft Defender require specialized setup and complex cloud connectors, your everyday document editing should be simple and reliable. WPS Office offers a lightweight, high-performance suite for all your productivity needs.
- 1. Download the Installer: Visit the official WPS Office website and download the free installer for your operating system.
- 2. Install WPS Office: Run the setup file and follow the on-screen prompts to complete the lightweight installation in minutes.
- 3. Open Your Files: Drag and drop your existing Microsoft Office documents into WPS Office to continue working securely and seamlessly.
Frequently Asked Questions
Why does my Microsoft 365 App connector show a status error?
Status errors typically occur due to missing API permissions, expired authentication tokens, or incomplete setup steps in the Microsoft Defender portal. You need to review the connector's permission settings and re-authenticate if necessary.
Does the Azure AD connector collect detailed cloud app activity?
No, the Azure AD connector is primarily used to sync user and group identities. To collect detailed cloud app activity and security events, you must explicitly enable and configure the Microsoft 365 App connector.
How long does it take for activity data to appear after configuring the connector?
Once the Microsoft 365 App connector is successfully connected without errors, it can take up to several hours for the initial synchronization to complete and for events to appear in the Activity log.
