Total Emails with Admin Overrides (Allow)
This query visualises the total amount of emails subject to an admin policy with action of allow, independent of action taken, summarizing the data by type of override
Microsoft Sentinel (KQL)

This query visualises the total amount of emails subject to an admin policy with action of allow, independent of action taken, summarizing the data by type of override

Already have an account?