Microsoft Security | Microsoft Defender | Microsoft Defender for Cloud Apps
A tool that provides visibility, control, and threat protection for cloud-based applications and services
Defender for Cloud apps
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(214.4, 12%, 30%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ELD%3C/text%3E%3C/svg%3E)
Lungisani Dlamini
0
Reputation points
I’ve configured granular access control in Microsoft Defender for Cloud Apps using device groups to allow or block access to specific cloud applications for example, ChatGPT. However, when I check app usage data, some users who were granted access to the application do not appear in the usage timeline for the past 30 days. One user, in particular, accessed ChatGPT yesterday, but their activity is missing from the app usage report.
When I checked the advanced KQL search, I saw logs confirming that the user has been actively using the app and quite frequently.
Microsoft Security | Microsoft Defender | Microsoft Defender for Cloud Apps
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(300.8, 28.000000000000004%, 39%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECK%3C/text%3E%3C/svg%3E)
Catherine Kyalo 2,620 Reputation points Microsoft Employee2025-11-25T15:01:47.8766667+00:00 For compliance or investigation, rely on KQL queries in Microsoft Defender XDR since they pull raw activity logs from Defender for Endpoint and Cloud Apps.
Sign in to comment
Sign in to answer