Queries for the MicrosoftPurviewInformationProtection table

For information on using these queries in the Azure portal, see Log Analytics tutorial. For the REST API, see Query.

Microsoft Purview Information Protection events

Microsoft Purview Information Protection events summarized by label event type and workload.

MicrosoftPurviewInformationProtection
| summarize Value=count() by LabelEventType, Workload
| order by Value