CallActivityEvents

  • Applies to: Microsoft Defender XDR

The CallActivityEvents table in the advanced hunting schema contains details about activities performed during Microsoft Teams calls in your organization.

This advanced hunting table is populated by records from Microsoft Defender for Office 365. If your organization hasn't deployed the service in Microsoft Defender, queries that use the table don't work or return any results. For more information about how to deploy Defender for Office 365 in the Defender portal, read Deploy supported services.

Schema

For information on other tables in the advanced hunting schema, see the advanced hunting reference.

Column name Data type Description
ActivityTimestamp datetime Date and time when the activity was recorded
CallId string Unique identifier for the call, as generated by Microsoft 365
ActivityId string Unique identifier for the activity, as generated by Microsoft 365
ActivityInitiatorId string Unique identifier for the participant who initiated the activity
ActivityType string Type of activity performed during the call
ThreadId string Unique identifier for the thread associated with the call
ActivityInitiatorUpn string User principal name of the participant who initiated the activity
ActivityInitiatorDisplayName string Display name of the participant who initiated the activity
CallSchedulingType string Type of scheduling for the call, such as Adhoc, Scheduled, or Recurring
CallJoinUrl string Link that participants use to join the call
OriginatorUserDisplayName string Display name of the caller who initiated the call
OriginatorUpn string User principal name of the caller who initiated the call
CallType string Type of call, for example, peer-to-peer (P2P) or group call (meeting, conference, or escalated call)
CallName string Name of the call as displayed in the calendar invite
ActivityDetail string Additional information about the activity performed
ActivityStatus string Success or failure of the activity performed
IsPerformedOnSelf boolean Indicates whether the activity initiator performed the action on themselves (True) or on another call participant (False)
ActivityInitiatorPhoneNumber string Third-party or Microsoft Teams phone number of the caller's account
ActivityInitiatorAccountType string Classification of how the activity initiator is provisioned in the organization; possible values: Entra, consumer, Azure Communication Services, Public Switched Telephone Network, Unauthenticated
ActivityInitiatorMembershipType string Membership type of the activity initiator relative to the tenant from which the activity is made
ActivityInitiatorTenantDisplayName string Name of the organization that the activity initiator belongs to
ActivityInitiatorTenantRegion string Geographical region of the tenant that the activity initiator belongs to
ActivityInitiatorPlatformName string Display name of the activity initiator's Teams client
ActivityInitiatorPlatformCategory string Category of the activity initiator's client platform; possible values: Desktop, Mobile, Web
OriginatorObjectId string Unique identifier for the user who organized the call or meeting invite
OriginatorTenantId string Unique identifier for the tenant of the user who organized the call or meeting invite
ActivityRecipientId string Unique identifier for the activity recipient
ActivityRecipientUpn string Unique identifier for the account of the activity recipient
ActivityRecipientPhoneNumber string Third-party or Microsoft Teams phone number of the activity recipient
ActivityRecipientDisplayName string Display name of the activity recipient's Teams client platform
ActivityRecipientAccountType string Classification of how the activity recipient is provisioned in the organization; possible values: Entra, consumer, Azure Communication Services, Public Switched Telephone Network, Unauthenticated
ActivityRecipientTenantDisplayName string Name of the organization that the activity recipient belongs to

Tip

Do you want to learn more? Engage with the Microsoft Security community in our Tech Community: Microsoft Defender XDR Tech Community.

  • Last updated on