Reporting the Use of Emojis in Teams Reactions

Find and Analyze How People Use Emojis as Teams Reactions

An interesting LinkedIn post expressed the opinion that it’s easier to learn some new technology by doing something fun with it. In this case, the author shows how to use KQL to interrogate Microsoft 365 audit data stored in Microsoft Sentinel to analyze the use of Teams emoji reactions for messages. Essentially, the idea is that if you can master KQL to query Sentinel data for emoji usage, you can do the same for more serious activities.

I decided that it would be a good idea to show how to do the same with PowerShell based on audit records from the unified audit log. The same data drives both repositories, so the same results should be achievable. I’ve added a little bit of extra value by showing how to display the emojis instead of just the emoji names, and I also report user display names instead of user principal names.

Teams Emojis

Teams offers a wide range of “fluent” emojis that people can use to react to chat and channel messages. Tenants can add their own custom emojis to the set provided by Microsoft. Up to twenty emojis can be used to react to a message. Basically, you can go wild with emojis should you like to react to messages in a blizzard of colorful emotions.

Audit events are captured when people use emojis to react to Teams chat and channel messages. Each emoji counts as a separate reaction, and each reaction is logged as a ReactedToMessage audit event.

Scripting the Emoji Analysis

The code in the script to analyze the use of emojis in Teams reactions is not very complex. Here’s what I did:

• Run Connect-MgGraph to connect to the Microsoft Graph PowerShell SDK to fetch details of user accounts (display names and user principal names). Because these are base properties, only the User.ReadBasic.All permission is needed. If you don’t want to see display names in the report, you don’t need this code.
• Run Connect-ExchangeOnline to connect to the Exchange Online management endpoint.
• Create a hash table and populate it with user principal names (keys) and display names (values). This data is used to translate the user principal names found in audit events into display names for the report.
• Create a hash table of emoji keyed on the emoji name and with the emoji graphics as the values. Microsoft doesn’t document the full set of Teams emojis, but I found this page useful. The hash table contains about 80 emojis from the full set. These are the emojis used in my tenant. Your tenant might differ, in which case you’ll need to add more key-value pairs to the hash table.
• Run the Search-UnifiedAuditLog cmdlet to find events with the ReactToMessage operation. If events are found, the script removes duplications (which can happen in audit results).
• Loop through the audit records and create a report of what’s found. The report includes instances where reactions are added or removed to chats or channel messages.
• Generate an Excel worksheet containing the data (if the ImportExcel module is not installed), the script creates a CSV file instead. Figure 1 shows some data extracted from my tenant.

The data can also be used for basis analysis. For instance, here’s how to find the count of the ten most used emojis, including the emoji fetched from the hash table:

Write-Output "Top Ten Emoji reactions used in Teams"    
$Report | Group-Object Reaction -NoElement | Sort-Object Count -Descending | Select-Object -First 10 | Format-Table Name,  @{name="Emoji"; Expression = { $Emojis[$_.Name] }}, Count -AutoSize

Top Ten Emoji reactions used in Teams

Name                      Emoji Count
----                      ----- -----
like                      👍      334
heart                     ❤️      109
laugh                     😂       31
surprised                 😮       26
yes-tone1                 👍🏻       18
1f4af_hundredpointssymbol 💯        8
like (Removed)                      8
follow                    👣        7
handsinair                🙌        7
fire                      🔥        7

And here’s how to find the top 10 emoji users:

$Report | Group-Object User -NoElement | Sort-Object Count -Descending | Select-Object -First 10 | Format-Table Name, Count

Name                                    Count
----                                    -----
Paul Robichaux | Keepit                   122
Christina Wheeler                         112
Tony Redmond                               96
Tony Sterling (Teams)                      67
Leah Theil | Keepit                        61
Juan Carlos González Martín                44
Michel de Rooij (MVP)                      41
Leah Theil                                 31
Ben Lee                                    18
Sean Landy (Office 365 for IT Pros)        11

A Learning Exercise

I doubt if the script (which you can download from the Office 365 for IT Pros repository) has any great business value. But learning how to access data in the unified audit log is a core skill for a Microsoft 365 tenant administrator. Being able to manipulate the audit data with PowerShell makes the data more powerful, and that’s why we learn how to do these things.

---

Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365. Only humans contribute to our work!