Active Users and events
You may need to estimate the active users and events on an M365 tenant. This can give us some useful statistics on the number of users who regularly use a 365 tenant and the number of audit events they produce.
These numbers may be required for
Assessing processing expectations (Audit events to benchmark the active user event load on the Octiga system)
Custom billing (Active Users)
There are a few important figures required:
Audit events
Go to Microsoft Purview Compliance Portal: https://compliance.microsoft.com
Navigate to Audit > Audit Search.
Set a date range for 7 days with times set to 00:00. The easiest way is to pick a week day on one week and select the same week day on the next week. Ensure that this covers a normal working time (not a holiday period)
Apply no filters (to get all events).
Click Search.
wait until the report is run. use refresh to update. Might take some time
Record the Total Results
Active Users per service
Go to https://admin.cloud.microsoft/?#/reportsUsage/LicenseActivity
Select 30 days
Take a screenshot or otherwise note these 3 metrics. Import to note Exchange and Teams active users and also the the number of active vs inactive users on the right
Summarize - Get the number of Normalized Users
This is not an exact science however you can take and note the following:
Total results from the Audit search
Active users (for exchange or teams, whichever higher)
Events per day = (Total Results) / (7 (days))
Normalized User Count = (Events per day) / 200 (NB 200 is the normal amount we see for users in our system)
Example
Total Results: 16958
Active users: 12 (on an average day )
Events Per day: = 16958 / 7 = 2,851 events per day
Number of Normalized Users: 2851 / 200 = 12 users