Office 365 Audit Logs: When do Events log to "My Workspace"

[ConnieMaldonado]

Hello - We are using Power BI extensively at my organization, and are using the Office 365 audit logs to monitor usage of activity in Power BI. We have established workspaces for various user groups within the organization and generally have a "DEV" and "PRD" workspace for each group for development environment and production. Once development is complete on a report, we move it to the PRD workspace.

On a nightly basis, we pull the Power BI related events from the O365 audit logs and post them to a table. I am in the process of creating a Power BI report to highlight key components of the usage, such as which dashboards and reports were viewed the most, what types of activities are being logged by users, etc. I noticed that many "ViewReport" and "ViewDashboard" events are logged from the "My Workspace" folder. I'm trying to figure out under what circumstances events such as ViewReport or ViewDashboard are logged to the My Workspace workspace. For myself, I never run reports from "My Workspace" but always access the report from the appropriate DEV or PRD workspace; however, on the audit log report, some of my event records are showing up with "My Workspace" as the workspace. This is a problem, as I would like to report on usage only within the PRD workspaces. We have about 3,500 technicians and site managers in the field and have published several reports for them. We'd like to know which site managers and technicians are using the reports (and which are not). I've created a filter to only display activity in PRD workspaces but am not sure if I should include "My Workspace" in the filter.

If this doesn't make sense, let me know, and any help is appreciated. Thanks!

[DougM]

Hi

I also have a query in this regard and have been unable to find any answers on the net.

Starting from 1 Oct, in the OS365 Audit trail, I am seeing Report usage being attributed to a WorkspaceName of "Wim" with a Workspace Id of "My Workspace". We do not have a defined workspace of Wim, and report usage I am expecting to see attributed to the applicable App workspaces is being attributed here.

All reports are published as Apps

Any ideas would be appreciated

Regards

Doug

[Stefan74]

Hi Doug,

we face exactly the same problem, but our Workspace in the Logs is not "Wim", but "Torsten", which is not created at all in our environment.

Any idea yet?

Thanks,
Stefan

[ConnieMaldonado]

Hello - We are using Power BI extensively at my organization, and are using the Office 365 audit logs to monitor usage of activity in Power BI.  We have established workspaces for various user groups within the organization and generally have a "DEV" and "PRD" workspace for each group for development environment and production.  Once development is complete on a report, we move it to the PRD workspace.

On a nightly basis, we pull the Power BI related events from the O365 audit logs and post them to a table.  I am in the process of creating a Power BI report to highlight key components of the usage, such as which dashboards and reports were viewed the most, what types of activities are being logged by users, etc.  I noticed that many "ViewReport" and "ViewDashboard" events are logged from the "My Workspace" folder.  I'm trying to figure out under what circumstances events such as ViewReport or ViewDashboard are logged to the My Workspace workspace.  For myself, I never run reports from "My Workspace" but always access the report from the appropriate DEV or PRD workspace; however, on the audit log report, some of my event records are showing up with "My Workspace" as the workspace.  This is a problem, as I would like to report on usage only within the PRD workspaces.  We have about 3,500 technicians and site managers in the field and have published several reports for them.  We'd like to know which site managers and technicians are using the reports (and which are not).  I've created a filter to only display activity in PRD workspaces but am not sure if I should include "My Workspace" in the filter.

If this doesn't make sense, let me know, and any help is appreciated.  Thanks!

[v-shex-msft]

Hi @ConnieMaldonado,

Below is the official document of audit log feature, it mentioned which events and properties will be record to log file.

Using auditing within your organization

Based on document, power bi only record which dashboard has been viewed, it not log any workspace related information. So I don't think you can fully achieve your requirement.

Regards,

Xiaoxin Sheng

[GilbertQ]

Hi there,

The only thing that comes to mind for me, could it not be when you first log into Power BI that it might default to My Workspace, which would then create the Audit Log for "My Workspace" as viewing reports or dashboards?

You could possibly correlate this to the times and see if it happens at those times?