Troubleshoot missing file events for Microsoft Office 365 email

Overview

The Incydr Microsoft Office 365 email data connection monitors your email environment to detect when a user emails an attachment to an untrusted user. However, no email file events appear in Incydr if you're connected to and monitoring the environment but aren't monitoring any email users in it. This article helps you resolve issues so that emailed file activity appears in Incydr as expected.

Resolve missing file events for Office 365 email

If file events aren't appearing in Incydr for email attachments, verify that:

• The email users that you want to monitor in your Microsoft environment:
  • Have an email account or mailbox
  • Are active users
  • Are included in the user or group scoping used to monitor your environment

• The Microsoft Office 365 email service has not been deauthorized in the Incydr console, and the Incydr/Code42 enterprise application exists in your Microsoft Azure environment with the correct permissions.

  Deauthorizing an email service in the Incydr console prevents Incydr from accessing or displaying that data. If the connection no longer exists in either your Incydr or Microsoft Office 365 environment, you need to re-add Microsoft Office 365 as an email data connection.

Related topics

• Connect Incydr to Microsoft Office 365 email
• Troubleshoot app permission errors for Microsoft OneDrive and Office 365 email
• Deauthorize and resume monitoring a data connection
• Scope a data connection