Table of contents
Microsoft365 Integration Overview
Microsoft 365 is one of the two primary entry points into WorkSights, alongside Google Workspace. The integration connects at the tenant level and provides visibility across Outlook email, Outlook Calendar, Teams calls, Teams chat, OneDrive, SharePoint, and login activity.
Some signals are available immediately after connecting. Others require Microsoft 365 audit logging to be active. This guide explains what WorkSights receives from each service and how the two data sources work together.
For connection steps, see Connecting Microsoft 365.
What WorkSights Receives
WorkSights ingests event-level metadata from Microsoft 365 services through two pipelines: the Microsoft Graph API and the Microsoft Unified Audit Log. No message content, file content, chat text, or sensitive payloads are ever stored.
Outlook Email
WorkSights receives sent email events and mailbox access events via Exchange Online. Subject lines, recipients, and message bodies are not available through Microsoft's APIs and are never received.
Outlook Calendar
WorkSights receives event titles, start and end times, and attendee metadata. Calendar data lets WorkSights classify time into internal meetings, external meetings, and calendar blocks.
Teams Calls
WorkSights receives call start and end times, duration, and partial attendee metadata when Microsoft provides it. Audio, video, transcripts, and meeting content are never received.
Teams Chats
WorkSights receives message-sent events and participation metadata from the Unified Audit Log. Message text, attachments, and thread history are never received. Requires audit logging to be active.
OneDrive and SharePoint
WorkSights receives file interaction events including views, edits, creates, renames, downloads, and deletions. File names and action types are shown. File contents, revision history, and collaboration details are never received. Requires audit logging to be active.
Login
WorkSights receives Azure AD login events including timestamps, event type, and IP-based location metadata. Requires audit logging to be active.
How Microsoft 365 Activity Appears
WorkSights displays Microsoft 365 activity using a consistent structure across services.
Outlook Email: Sent emails appear as short scored entries. Mailbox access events appear as lightweight non-scored markers.
Outlook Calendar: Events are color-coded by type. Internal meetings, external meetings, and calendar blocks each use a distinct color. Events longer than ten hours are excluded from scoring.
Teams Calls: Calls appear with actual start and end times. Multiple join/leave events for the same call are consolidated into a single block during nightly processing.
Teams Chats: Chat participation events appear as short communication entries. Message content is never shown.
OneDrive and SharePoint: Repeated editing events on the same file are compacted into a single block during nightly processing. Only file names are shown.
Login: Login events appear as short one-minute entries reflecting when a user authenticated.
Audit Log Dependency
Several Microsoft 365 signals depend on the Unified Audit Log being active for your tenant. Without it, Teams chat, OneDrive and SharePoint file activity, and login events will not appear. Outlook email and calendar activity are available regardless.
If these signals are missing, see Microsoft 365 Audit Log Activation for steps to verify and enable audit logging.
Data Processing
WorkSights receives only metadata. Message content, file content, chat text, audio, video, recordings, and transcript data are never received or stored.
Microsoft generates some system-level events that do not reflect real user activity. WorkSights filters these during nightly processing so timelines stay accurate.
Repeated editing sessions and multi-join call events are compacted to reflect meaningful activity blocks rather than raw event volume.
Troubleshooting
If Microsoft 365 activity is not appearing as expected:
- Confirm the Microsoft 365 tenant connection is active in Settings under Connected Services.
- Check that the affected user exists in the WorkSights user list and has been assigned a role.
- Teams chat, OneDrive, SharePoint, and login activity all require audit logging. If these signals are missing, see Microsoft 365 Audit Log Activation.
- Audit log data refreshes multiple times per day. Allow several hours after enabling audit logging before expecting activity to appear.
- For persistent issues, contact support via the in-app chat.