Metrics Library

Microsoft 365 Licensing Metric designed for Power BI consumption. Licensing[].{ProductFriendlyName: ProductFriendlyName, Consumed: consumedUnits, Unconsumed: UnconsumedUnits_r, Suspended: prepaidUnits.suspended}

This will find any SSO certificates that are going to expire in 30 days or less. ServicePrincipals[?preferredTokenSigningKeyEndDateTime != null && time_until(preferredTokenSigningKeyEndDateTime, days ) < 30 ].displayName

Looks for applications with expiring/expired secrets (within 30 days), then outputs the Application name, and the secrets associated that are expiring/expired. Applications[?passwordCredentials[?time_until(endDateTime, days ) < 30 ].endDateTime].['Application Name: 'displayName, 'Secret Name: 'passwordCredentials[?time_until(endDateTime, days ) < 30 ].displayName]

Counts the number of days since the last Azure Active Directory Connect (AADC) sync. Useful for determining if there is an issue as it should always be <1. SystemInfo.DirectorySync[?DaysSinceLastSync_r > 0 ] | length(@)

Total Count of Sentinel One Agents Agents[]| length(@)

Generates a list of hostnames that are non-compliant with the Windows Defender policy. Agents[?defender_policy_status == 'Non Compliant'].hostname

Generates a count of hostnames that are non-compliant with the Windows Defender policy. length(Agents[?defender_policy_status == 'Non Compliant'])

This metric will assess whether your workstations are compatible with the upgrade to Windows 11. contains(OS.OperatingSystemName, Microsoft Windows 10 ) && OS.Windows11Compatible == false && No || Yes

This is helpful to someone who's trying to obtain/maintain visibility into the admin users in an organization's M365 instance. This is a good Metric for QBRs, recurring site reviews, and an onboarding report. Also, this Metric could be used to build a user audit with the intention of an end customer confirming that all looks as expected. This Metric can also be used to create a pointed Actionable Alert that helps to maintain visibility into changes to this list. Roles[? contains(displayName, dmin ) && displayName != Company Administrator && Members[] != null && Members[] != [] ].join( , [join( , [ , to_string(displayName)]), join( , [ : , to_string(Members[].displayName)])])

This is helpful to someone who's trying to obtain/maintain visibility into the non-admin users in an organization's M365 instance. This is a good Metric for QBRs, recurring site reviews, and an onboarding report. Also, this Metric could be used to build a user audit with the intention of an end customer confirming that all looks as expected. This Metric can also be used to create a pointed Actionable Alert that helps to maintain visibility into changes to the list of Admin users with MFA disabled. Users[? Privileged == Yes && isMfaRegistered_r == Enabled ].displayName