Table of Contents
Use Audit Records to Track Usage of the Loop App
Following last week’s announcement about external access support for the Loop app, thoughts might turn to understanding how many people within a tenant use the app. In fact, there are two categories of users: those with a license that includes the Microsoft Loop service plan (identifier c4b8c31a-fb44-4c65-9837-a21f55fcabda), and those who do not. The latter category includes anyone without a Microsoft 365 E3, E5, or Business Standard or Premium license. For now, these users can create new workspaces with the Loop app, but from June 30, 2024, they lose that capability when Microsoft enforces license requirements (Figure 1).
Identifying Usage of the Loop App
The task then is to identify who’s using the Loop app and if they have the right license. Thinking about the problem, you could use the approach explained in this article to report Loop workspaces. The PowerShell script reports workspaces and members and doesn’t tell us who is actively using the Loop app. A different approach is necessary to detect actual usage, and as normal in these situations, the unified audit log is a good place to look for information.
The Loop app supports a wide range of compliance features and logging its activities in the audit log is included. This shouldn’t be surprising because the Loop app uses SharePoint embedded and the audit log captures its actions to add, update, or remove workspaces just like it does for “normal” user file actions in SharePoint Online and OneDrive for Business.
It’s therefore possible to search the audit log to look for file actions performed by the Loop app (identifier a187e399-0c36-4b98-8f04-1edc167a0996) to understand who’s using the app.
Interrogating the Audit Log for Loop App Activities
I therefore wrote a PowerShell script (downloadable from GitHub) to do the following:
- Connect to Exchange Online and the Microsoft Graph (Connect-MgGraph).
- Find the set of users licensed to use the Loop app.
- Find the set of users not licensed to use the Loop app.
- Run the Search-UnifiedAuditLog cmdlet to search the unified audit log to find SharePoint file events like FileModified or FileModifiedExtended.
- Filter the retrieved set of audit events to find the set applicable to the Loop app.
- Sort the set by user principal name to find a unique set of users who have used the Loop app over the last 15 days (the period is customizable).
- Check against the set to find licensed and unlicensed users who have used the Loop app. Also find licensed users who haven’t used the Loop app. This is a perfectly normal situation. The users might not have wanted to use the app, or they have been absent during the review period.
- Report everything (using the Out-GridView cmdlet and by exporting to a CSV file).
It was a fun script to write. Between the two approaches (usage activity and workspace information), you have enough information to know exactly what’s happening with the Loop app within a Microsoft 365 tenant (Figure 2).
Next Steps
An immediate action is to assess if the people using the Loop app without a license are doing so in a productive manner. If they are and they want to continue using the app after June 30, 2024, they need to be assigned an eligible license (perhaps swapping with someone who has an eligible license but isn’t using the licensed features). After that, it’s a good idea to acquaint the Loop users with new capabilities. Perhaps you can create a Microsoft 365 group or distribution list to inform people when features like external access are available. Proactive communication is always better than reactive updates.
Learn how to exploit the data available to Microsoft 365 tenant administrators through the Office 365 for IT Pros eBook. We love figuring out how things work.