CloudAppEvents
CloudAppEvents contains events involving accounts and objects in Microsoft 365 and other SaaS/cloud apps and services. Microsoft documents this table as populated by Microsoft Defender for Cloud Apps.
tablesCurrent
Relationships
Schema
| Field | Type | Description | Copy |
|---|---|---|---|
Timestamp | datetime | Date and time when the event was recorded. | |
ActionType | string | Type of activity that triggered the event. | |
Application | string | Application that performed the recorded action. | |
AccountObjectId | string | Unique identifier for the account in Microsoft Entra ID. | |
IPAddress | string | IP address assigned to the device during communication. | |
AuditSource | string | Audit source such as Defender for Cloud Apps access control, session control, or app connector. | |
RawEventData | dynamic | Raw event information from the source application or service in JSON format. | |
OAuthAppId | string | OAuth application identifier assigned when an app is registered in Microsoft Entra ID. |
Sample KQL
Recent SaaS activity by app
Summarize connected SaaS activity recorded through Defender for Cloud Apps.
kql
CloudAppEvents
| where Timestamp > ago(24h)
| summarize Events=count() by Application, ActionType
| top 20 by Events