You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I'm using Microsoft OpenTelemetry Distro to add the governance/observability layer to my agent, which is built with Microsoft Agent Framework.
When I run my agent, I can see that all spans are successfully sent to Agent365 Observability with an HTTP 200 response. Here is the log:
DEBUG:microsoft.opentelemetry.a365.core.exporters.agent365_exporter:Found 1 identity groups with 4 total spans to export
DEBUG:microsoft.opentelemetry.a365.core.exporters.agent365_exporter:Exporting 4 spans to endpoint: https://agent365.svc.cloud.microsoft/observabilityService/tenants/<TENANT_ID>/otlp/agents/<AGENT_ID>/traces?api-version=1
DEBUG:microsoft.opentelemetry.a365.core.exporters.agent365_exporter:Sending chunk 1 of 1 (4 spans, 4334 bytes)
DEBUG:urllib3.connectionpool:https://agent365.svc.cloud.microsoft:443 "POST /observabilityService/tenants/<TENANT_ID>/otlp/agents/<AGENT_ID>/traces?api-version=1 HTTP/1.1" 200 564
DEBUG:microsoft.opentelemetry.a365.core.exporters.agent365_exporter:HTTP 200 success on attempt 1. Correlation ID: <CORRELATION_ID>. Response: {"results":[{"spanId":"<SPAN_ID>","sinks":{"flashpoint":{"status":"sent"},"sentinel":{"status":"sent"},"esp":{"status":"sent"}}},{"spanId":"<SPAN_ID_2>","sinks":{"flashpoint":{"status":"se...
However, no activity shows up on the Agent 365 side when I access my agent, specifically in the Activity tab.
Please note that my agent is not a conversational agent, it is not published to a channel (like MS Teams) — it's an agent invoked directly through code calls.
nada haninou (@nadahaninou) Could you share the code for the application you are using? Also if you set enable_console=True in use_microsoft_opentelemetry you might be able to see the logs which can help identify why the spans don't end up in the activity tab. It would be quite helpful if you could share those logs as well.
Fallback fix: some auto-instrumented residual spans don't carry the
correct agent_id, so we force-align them to the registered agent id
before export.
import microsoft.opentelemetry.a365.core.exporters.agent365_exporter as _a365_exporter_module
from microsoft.opentelemetry.a365.core.exporters.enriched_span import EnrichedReadableSpan
from microsoft.opentelemetry.a365.core.exporters.utils import (
filter_and_partition_by_identity as _original_filter_and_partition,
)
from microsoft.opentelemetry.a365.constants import GEN_AI_AGENT_ID_KEY, TENANT_ID_KEY
def _patched_filter_and_partition_by_identity(spans):
groups = _original_filter_and_partition(spans)
merged: dict[tuple[str, str], list] = {}
for (tenant_id, agent_id), spans_list in groups.items():
target_key = (tenant_id, AGENT_ID)
if agent_id != AGENT_ID:
spans_list = [
EnrichedReadableSpan(sp, {GEN_AI_AGENT_ID_KEY: AGENT_ID, TENANT_ID_KEY: tenant_id})
for sp in spans_list
]
merged.setdefault(target_key, []).extend(spans_list)
return merged
nada haninou (@nadahaninou) I see the issue, you need to enable the A365 exporter explicitly to actually let the exporter export to the A365 endpoint. From the code I see you are not using the enable_a365_observability_exporter=True in use_microsoft_opentelemetry. Have you by any chance set the environment variable instead - ENABLE_A365_OBSERVABILITY_EXPORTER? You need to set either to actually export the spans to the endpoint. Can you try doing that and see if that works?
nada haninou (@nadahaninou) Is this the first time trying out this setup? Have you earlier been able to see the traces? Also, you mentioned that you don't see any activity under the Activity tab, are you referring to the Microsoft A365 admin center portal? Have you tried using an agent in teams?
Hello Radhika Gupta (@rads-1996) ,thank you for you answer, below my answers to your questions:
Is this the first time trying out this setup? → Yes
Have you earlier been able to see the traces? → No
You mentioned that you don't see any activity under the Activity tab, are you referring to the Microsoft A365 admin center portal? → Yes
Have you tried using an agent in Teams? → My agents will only be used via code, not via channels (like MS Teams).
My purpose with this work is to export telemetry from pro-code agents to Microsoft Agent 365. My agents will not be used through a channel (like MS Teams) — they are invoked directly via code.
Hello Nikhil Navakiran (@nikhilNava) Thanks for the pointer to the attribute reference! I added the missing required attributes (microsoft.agent.user.id, microsoft.agent.user.email via AgentDetails.agentic_user_id/agentic_user_email, and user.id, user.email, client.address via CallerDetails(user_details=UserDetails(...))). All required attributes from the reference table now appear on the invoke_agent span — see attached log.
nada haninou (@nadahaninou) can you share the correlation ID so I see if all the sinks are receiving your data? if possible please share the tenant id as well.
The observability service receives the payload and sent to collectors downstream. The Admin center is one such collector.
Ideally, you'll have to create an ICM so the relevant team can look into it.
Hello Nikhil Navakiran (@nikhilNava) thank you for your help, sorry for delay ,this is the correlation id : a5355583-2cef-4c1c-96ec-c5b9636f5f32 and this is the tenant id: 7028dd86-503a-4448-b13d-88e2776ecfee.
Can you please help me with this topic? and thank you very much.
Hi nada haninou (@nadahaninou) - Apologies for the delay. On the tenant shared
I reviewed your recent agent invocation telemetry and confirmed that you're sending everything expected, including the required attributes, user ID, and user email.
The data is successfully landing in your tenant across all three destinations we checked: Sentinel, observability storage, and analytics. We found no ingestion failures or missing required attributes in the latest five agent invocation spans.
Activity
github-actions commentedon Jul 23, 2026
cc Hector Hernandez (@hectorhdzg) Jackson Weber (@JacksonWeber) Leighton Chen (@lzchen) Nev (@MSNev) Radhika Gupta (@rads-1996) Jeremy Voss (@jeremydvoss)
rads-1996 commentedon Jul 23, 2026
nada haninou (@nadahaninou) Could you share the code for the application you are using? Also if you set
enable_console=Trueinuse_microsoft_opentelemetryyou might be able to see the logs which can help identify why the spans don't end up in the activity tab. It would be quite helpful if you could share those logs as well.nadahaninou commentedon Jul 23, 2026
Hello Radhika Gupta (@rads-1996) , Thanks for the quick reply!
This is my code
import asyncio
import logging
import os
import time
from dotenv import load_dotenv
from msal import ConfidentialClientApplication
from microsoft.opentelemetry import use_microsoft_opentelemetry
from microsoft.opentelemetry.a365.core import (
AgentDetails,
BaggageBuilder,
Channel,
InferenceCallDetails,
InferenceOperationType,
InferenceScope,
InvokeAgentScope,
InvokeAgentScopeDetails,
Request,
ServiceEndpoint,
)
from agent_framework import Agent
from agent_framework.foundry import FoundryChatClient
from azure.identity import AzureCliCredential
logging.basicConfig(level=logging.DEBUG)
load_dotenv()
------------------------------------------------------------------
Entra ID (S2S) - two-step flow for Agentic applications
------------------------------------------------------------------
TENANT_ID = os.getenv("TENANT_ID")
BLUEPRINT_CLIENT_ID = os.getenv("CLIENT_ID")
BLUEPRINT_CLIENT_SECRET = os.getenv("CLIENT_SECRET")
AGENT_ID = "<AGENT_ID>" # Agent identity (agenticAppId)
AGENT_BLUEPRINT_ID = "<AGENT_BLUEPRINT_ID>" # Blueprint app id
OBSERVABILITY_SCOPE = ["api://<OBSERVABILITY_RESOURCE_ID>/.default"]
AZURE_AD_TOKEN_EXCHANGE_SCOPE = ["api://AzureAdTokenExchange/.default"]
_token_cache = {}
def get_access_token(agent_id: str) -> str:
if agent_id != AGENT_ID:
agent_id = AGENT_ID
------------------------------------------------------------------
OpenTelemetry
------------------------------------------------------------------
from agents import set_tracing_disabled
set_tracing_disabled(True)
use_microsoft_opentelemetry(
enable_a365=True,
enable_console=True,
a365_use_s2s_endpoint=True,
a365_token_resolver=lambda agent_id, tenant_id: get_access_token(agent_id),
)
Fallback fix: some auto-instrumented residual spans don't carry the
correct agent_id, so we force-align them to the registered agent id
before export.
import microsoft.opentelemetry.a365.core.exporters.agent365_exporter as _a365_exporter_module
from microsoft.opentelemetry.a365.core.exporters.enriched_span import EnrichedReadableSpan
from microsoft.opentelemetry.a365.core.exporters.utils import (
filter_and_partition_by_identity as _original_filter_and_partition,
)
from microsoft.opentelemetry.a365.constants import GEN_AI_AGENT_ID_KEY, TENANT_ID_KEY
def _patched_filter_and_partition_by_identity(spans):
groups = _original_filter_and_partition(spans)
merged: dict[tuple[str, str], list] = {}
for (tenant_id, agent_id), spans_list in groups.items():
target_key = (tenant_id, AGENT_ID)
if agent_id != AGENT_ID:
spans_list = [
EnrichedReadableSpan(sp, {GEN_AI_AGENT_ID_KEY: AGENT_ID, TENANT_ID_KEY: tenant_id})
for sp in spans_list
]
merged.setdefault(target_key, []).extend(spans_list)
return merged
_a365_exporter_module.filter_and_partition_by_identity = _patched_filter_and_partition_by_identity
------------------------------------------------------------------
Main
------------------------------------------------------------------
async def main():
if name == "main":
asyncio.run(main())
and this is the log output after running it with the parameter enable_console=True in use_microsoft_opentelemetry
INFO:microsoft.opentelemetry.a365.core.opentelemetry_scope:Span started: 'invoke_agent HelloAgent' (1207e2741fe70df6)
INFO:microsoft.opentelemetry.a365.core.opentelemetry_scope:Span started: 'Chat <MODEL_NAME>' (e46237658d5b346b)
{
"name": "chat <MODEL_NAME>",
"context": {
"trace_id": "0x<TRACE_ID>",
"span_id": "0x<SPAN_ID>",
"trace_state": "[]"
},
"kind": "SpanKind.INTERNAL",
"parent_id": "0x<PARENT_SPAN_ID>",
"start_time": "2026-07-23T15:38:54.656855Z",
"end_time": "2026-07-23T15:39:03.556906Z",
"status": { "status_code": "UNSET" },
"attributes": {
"microsoft.tenant.id": "<TENANT_ID>",
"gen_ai.conversation.id": "conversation-001",
"gen_ai.agent.id": "<REGISTERED_AGENT_ID>",
"gen_ai.request.choice.count": 1,
"gen_ai.operation.name": "chat",
"gen_ai.provider.name": "azure.ai.foundry",
"server.address": "Unknown",
"gen_ai.request.model": "<MODEL_NAME>",
"gen_ai.response.id": "resp_<RESPONSE_ID>",
"gen_ai.response.model": "<MODEL_VERSION>",
"gen_ai.usage.input_tokens": 29,
"gen_ai.usage.output_tokens": 8,
"gen_ai.usage.cache_read.input_tokens": 0,
"gen_ai.usage.reasoning.output_tokens": 0
},
"events": [],
"links": [],
"resource": {
"attributes": {
"telemetry.sdk.language": "python",
"telemetry.sdk.name": "opentelemetry",
"telemetry.sdk.version": "1.43.0",
"service.instance.id": "<SERVICE_INSTANCE_ID>",
"service.name": "unknown_service"
},
"schema_url": ""
}
}
{
"name": "invoke_agent HelloAgent",
"context": {
"trace_id": "0x<TRACE_ID>",
"span_id": "0x<SPAN_ID>",
"trace_state": "[]"
},
"kind": "SpanKind.INTERNAL",
"parent_id": "0x<CHAT_SPAN_ID>",
"start_time": "2026-07-23T15:38:54.656424Z",
"end_time": "2026-07-23T15:39:03.558967Z",
"status": { "status_code": "UNSET" },
"attributes": {
"microsoft.tenant.id": "<TENANT_ID>",
"gen_ai.conversation.id": "conversation-001",
"gen_ai.request.choice.count": 1,
"gen_ai.operation.name": "invoke_agent",
"gen_ai.provider.name": "microsoft.agent_framework",
"gen_ai.agent.id": "<AUTO_GENERATED_AGENT_ID>",
"gen_ai.agent.name": "HelloAgent",
"gen_ai.request.model": "<MODEL_NAME>",
"gen_ai.usage.input_tokens": 29,
"gen_ai.usage.output_tokens": 8,
"gen_ai.usage.cache_read.input_tokens": 0,
"gen_ai.usage.reasoning.output_tokens": 0
},
"events": [],
"links": [],
"resource": {
"attributes": {
"telemetry.sdk.language": "python",
"telemetry.sdk.name": "opentelemetry",
"telemetry.sdk.version": "1.43.0",
"service.instance.id": "<SERVICE_INSTANCE_ID>",
"service.name": "unknown_service"
},
"schema_url": ""
}
}
INFO:microsoft.opentelemetry.a365.core.opentelemetry_scope:Span ended: 'Chat <MODEL_NAME>' (e46237658d5b346b)
{
"name": "Chat <MODEL_NAME>",
"context": {
"trace_id": "0x<TRACE_ID>",
"span_id": "0x<CHAT_SPAN_ID>",
"trace_state": "[]"
},
"kind": "SpanKind.CLIENT",
"parent_id": "0x<INVOKE_AGENT_SPAN_ID>",
"start_time": "2026-07-23T15:38:54.654515Z",
"end_time": "2026-07-23T15:39:03.559657Z",
"status": { "status_code": "UNSET" },
"attributes": {
"telemetry.sdk.name": "microsoft-opentelemetry",
"telemetry.sdk.language": "python",
"telemetry.sdk.version": "1.3.5",
"gen_ai.agent.id": "<REGISTERED_AGENT_ID>",
"gen_ai.agent.name": "HelloAgent",
"gen_ai.agent.description": "A friendly assistant agent",
"microsoft.a365.agent.blueprint.id": "<BLUEPRINT_ID>",
"microsoft.tenant.id": "<TENANT_ID>",
"gen_ai.conversation.id": "conversation-001",
"gen_ai.operation.name": "Chat",
"gen_ai.request.model": "<MODEL_NAME>",
"gen_ai.provider.name": "azure-foundry",
"microsoft.channel.name": "console",
"gen_ai.input.messages": "[{"role": "user", "parts": [{"content": "What is the capital of France?", "type": "text"}]}]",
"gen_ai.output.messages": "[{"role": "assistant", "parts": [{"content": "The capital of France is Paris.", "type": "text"}], "finish_reason": "stop"}]"
},
"events": [],
"links": [],
"resource": {
"attributes": {
"telemetry.sdk.language": "python",
"telemetry.sdk.name": "opentelemetry",
"telemetry.sdk.version": "1.43.0",
"service.instance.id": "<SERVICE_INSTANCE_ID>",
"service.name": "unknown_service"
},
"schema_url": ""
}
}
INFO:microsoft.opentelemetry.a365.core.opentelemetry_scope:Span ended: 'invoke_agent HelloAgent' (1207e2741fe70df6)
{
"name": "invoke_agent HelloAgent",
"context": {
"trace_id": "0x<TRACE_ID>",
"span_id": "0x<INVOKE_AGENT_SPAN_ID>",
"trace_state": "[]"
},
"kind": "SpanKind.CLIENT",
"parent_id": null,
"start_time": "2026-07-23T15:38:54.652194Z",
"end_time": "2026-07-23T15:39:03.560196Z",
"status": { "status_code": "UNSET" },
"attributes": {
"gen_ai.operation.name": "invoke_agent",
"telemetry.sdk.name": "microsoft-opentelemetry",
"telemetry.sdk.language": "python",
"telemetry.sdk.version": "1.3.5",
"gen_ai.agent.id": "<REGISTERED_AGENT_ID>",
"gen_ai.agent.name": "HelloAgent",
"gen_ai.agent.description": "A friendly assistant agent",
"microsoft.a365.agent.blueprint.id": "<BLUEPRINT_ID>",
"microsoft.tenant.id": "<TENANT_ID>",
"microsoft.session.id": "session-001",
"gen_ai.conversation.id": "conversation-001",
"server.address": "localhost",
"microsoft.channel.name": "console",
"gen_ai.input.messages": "[{"role": "user", "parts": [{"content": "What is the capital of France?", "type": "text"}]}]",
"gen_ai.output.messages": "[{"role": "assistant", "parts": [{"content": "The capital of France is Paris.", "type": "text"}], "finish_reason": "stop"}]"
},
"events": [],
"links": [],
"resource": {
"attributes": {
"telemetry.sdk.language": "python",
"telemetry.sdk.name": "opentelemetry",
"telemetry.sdk.version": "1.43.0",
"service.instance.id": "<SERVICE_INSTANCE_ID>",
"service.name": "unknown_service"
},
"schema_url": ""
}
}
DEBUG:microsoft.opentelemetry.a365.core.exporters.agent365_exporter:Found 1 identity groups with 4 total spans to export
DEBUG:microsoft.opentelemetry.a365.core.exporters.agent365_exporter:Exporting 4 spans to endpoint: https://agent365.svc.cloud.microsoft/observabilityService/tenants/<TENANT_ID>/otlp/agents/<AGENT_ID>/traces?api-version=1
DEBUG:microsoft.opentelemetry.a365.core.exporters.agent365_exporter:Sending chunk 1 of 1 (4 spans, 4334 bytes)
DEBUG:urllib3.connectionpool:https://agent365.svc.cloud.microsoft:443 "POST /observabilityService/tenants/<TENANT_ID>/otlp/agents/<AGENT_ID>/traces?api-version=1 HTTP/1.1" 200 564
DEBUG:microsoft.opentelemetry.a365.core.exporters.agent365_exporter:HTTP 200 success on attempt 1. Correlation ID: <CORRELATION_ID>. Response: {"results":[{"spanId":"<SPAN_ID>","sinks":{"flashpoint":{"status":"sent"},"sentinel":{"status":"sent"},"esp":{"status":"sent"}}},{"spanId":"<SPAN_ID_2>","sinks":{"flashpoint":{"status":"se...
rads-1996 commentedon Jul 23, 2026
nada haninou (@nadahaninou) I see the issue, you need to enable the A365 exporter explicitly to actually let the exporter export to the A365 endpoint. From the code I see you are not using the
enable_a365_observability_exporter=Trueinuse_microsoft_opentelemetry. Have you by any chance set the environment variable instead -ENABLE_A365_OBSERVABILITY_EXPORTER? You need to set either to actually export the spans to the endpoint. Can you try doing that and see if that works?nadahaninou commentedon Jul 23, 2026
Thanks for looking into this! But I already have ENABLE_A365_OBSERVABILITY_EXPORTER=true set in my .env file
rads-1996 commentedon Jul 23, 2026
nada haninou (@nadahaninou) Is this the first time trying out this setup? Have you earlier been able to see the traces? Also, you mentioned that you don't see any activity under the Activity tab, are you referring to the Microsoft A365 admin center portal? Have you tried using an agent in teams?
nadahaninou commentedon Jul 23, 2026
Hello Radhika Gupta (@rads-1996) ,thank you for you answer, below my answers to your questions:
Is this the first time trying out this setup? → Yes
Have you earlier been able to see the traces? → No
You mentioned that you don't see any activity under the Activity tab, are you referring to the Microsoft A365 admin center portal? → Yes
Have you tried using an agent in Teams? → My agents will only be used via code, not via channels (like MS Teams).
My purpose with this work is to export telemetry from pro-code agents to Microsoft Agent 365. My agents will not be used through a channel (like MS Teams) — they are invoked directly via code.
nikhilNava commentedon Jul 23, 2026
Hi nada haninou (@nadahaninou) - for the spans emitted ensure all the required attributes are present.
https://learn.microsoft.com/en-us/microsoft-agent-365/developer/observability?tabs=python#invokeagentscope-attributes
refer to the guide above.
This should help with the activity tab.
nadahaninou commentedon Jul 24, 2026
Hello Nikhil Navakiran (@nikhilNava) Thanks for the pointer to the attribute reference! I added the missing required attributes (microsoft.agent.user.id, microsoft.agent.user.email via AgentDetails.agentic_user_id/agentic_user_email, and user.id, user.email, client.address via CallerDetails(user_details=UserDetails(...))). All required attributes from the reference table now appear on the invoke_agent span — see attached log.
{
"name": "invoke_agent HelloAgent",
"context": {
"trace_id": "0x<TRACE_ID>",
"span_id": "0x<SPAN_ID>",
"trace_state": "[]"
},
"kind": "SpanKind.CLIENT",
"parent_id": null,
"start_time": "2026-07-24T12:42:34.824370Z",
"end_time": "2026-07-24T12:42:49.545880Z",
"status": {
"status_code": "UNSET"
},
"attributes": {
"gen_ai.operation.name": "invoke_agent",
"telemetry.sdk.name": "microsoft-opentelemetry",
"telemetry.sdk.language": "python",
"telemetry.sdk.version": "1.3.5",
"gen_ai.agent.id": "<AGENT_ID>",
"gen_ai.agent.name": "HelloAgent",
"gen_ai.agent.description": "A friendly assistant agent",
"microsoft.agent.user.id": "<AGENT_ID>",
"microsoft.agent.user.email": "<AGENT_ID>@<TENANT_ID>.onmicrosoft.com",
"microsoft.a365.agent.blueprint.id": "<BLUEPRINT_ID>",
"microsoft.tenant.id": "<TENANT_ID>",
"microsoft.session.id": "session-001",
"gen_ai.conversation.id": "conversation-001",
"server.address": "localhost",
"microsoft.channel.name": "console",
"user.id": "system",
"user.email": "system@localhost",
"client.address": "127.0.0.1",
"gen_ai.input.messages": "[{"role": "user", "parts": [{"content": "What is the capital of France?", "type": "text"}]}]",
"gen_ai.output.messages": "[{"role": "assistant", "parts": [{"content": "The capital of France is Paris.", "type": "text"}], "finish_reason": "stop"}]"
},
"events": [],
"links": [],
"resource": {
"attributes": {
"telemetry.sdk.language": "python",
"telemetry.sdk.name": "opentelemetry",
"telemetry.sdk.version": "1.43.0",
"service.instance.id": "<SERVICE_INSTANCE_ID>",
"service.name": "unknown_service"
},
"schema_url": ""
}
}
DEBUG:microsoft.opentelemetry.a365.core.exporters.agent365_exporter:Found 1 identity groups with 4 total spans to export
DEBUG:microsoft.opentelemetry.a365.core.exporters.agent365_exporter:Exporting 4 spans to endpoint: https://agent365.svc.cloud.microsoft/observabilityService/tenants/<TENANT_ID>/otlp/agents/<AGENT_ID>/traces?api-version=1
DEBUG:microsoft.opentelemetry.a365.core.exporters.agent365_exporter:Sending chunk 1 of 1 (4 spans, 4789 bytes)
DEBUG:urllib3.connectionpool:https://agent365.svc.cloud.microsoft:443 "POST /observabilityService/tenants/<TENANT_ID>/otlp/agents/<AGENT_ID>/traces?api-version=1 HTTP/1.1" 200 564
DEBUG:microsoft.opentelemetry.a365.core.exporters.agent365_exporter:HTTP 200 success on attempt 1. Correlation ID: <CORRELATION_ID>. Response: {"results":[{"spanId":"<SPAN_ID>","sinks":{"flashpoint":{"status":"sent"},"sentinel":{"status":"sent"},"esp":{"status":"sent"}}},{"spanId":"<SPAN_ID_2>","sinks":{"flashpoint":{"status":"se...
Export still succeeds with 200 and all spans confirmed "sent" on every sink.But no activity appears in tab activity of Agent 365 Admin center.
Do you have any idea how i can solve this problem? thank you very much for your help.
nikhilNava commentedon Jul 28, 2026
nada haninou (@nadahaninou) can you share the correlation ID so I see if all the sinks are receiving your data? if possible please share the tenant id as well.
The observability service receives the payload and sent to collectors downstream. The Admin center is one such collector.
Ideally, you'll have to create an ICM so the relevant team can look into it.
nadahaninou commentedon Aug 4, 2026
Hello Nikhil Navakiran (@nikhilNava) thank you for your help, sorry for delay ,this is the correlation id : a5355583-2cef-4c1c-96ec-c5b9636f5f32 and this is the tenant id: 7028dd86-503a-4448-b13d-88e2776ecfee.
Can you please help me with this topic? and thank you very much.
rads-1996 commentedon Sep 10, 2026
Nikhil Navakiran (@nikhilNava) Do you mind taking a look at the user's response. Thanks!
nikhilNava commentedon Oct 19, 2026
Hi nada haninou (@nadahaninou) - Apologies for the delay. On the tenant shared
I reviewed your recent agent invocation telemetry and confirmed that you're sending everything expected, including the required attributes, user ID, and user email.
The data is successfully landing in your tenant across all three destinations we checked: Sentinel, observability storage, and analytics. We found no ingestion failures or missing required attributes in the latest five agent invocation spans.
Review the steps below to view logs in defender and purview
https://learn.microsoft.com/en-us/microsoft-agent-365/developer/archive/observability-sdk?tabs=python#viewing-exported-logs
Sample defender query
Once the above is set up go to
https://security.microsoft.com/v2/advanced-hunting
run query
If you are still seeing issues, I would recommend you raise an ICM