Describe the bug
Link to workbook:
https://github.com/Azure/Azure-Sentinel/blob/master/Workbooks/SharePointAndOneDrive.json

The "SharePoint and OneDrive workbook" parameter "Users" does not work when "All" operations are selected.

It appears the intended functionality is to perform a unique user ID lookup based on the operations selected via dropdown. However, when the option "all" is selected for operations the only option available for Users is "all". This is not desirable when you want to filter on a specific user ID when using "all" operations.

The KQL statement for the Users list is looking for a dynamic/array in variable "operations", but if the operations drop down is selected as "all" there are no results returned as the queries throughout the workbook use a "where all or checkbox items" logic and label for the parameter. This means the Users lookup is matching on a null variable lookup from "operations" and no user IDs are returned.

The solution I used was to check the Operations parameter for "all" and if so return a list of all users IDs.

Link to the specific line:

To Reproduce
Steps to reproduce the behavior:

1. The workbook in your environment.
2. Click a time range with sufficient data.
3. Select "all" in Operations.
4. Select the drop down for Users. You will only have "all" as an option for the users.
5. Edit the workbook paste in the JSON line below under the parameter section for "users".
6. Repeat step 3, and on step 4 you can select from any user id.

Expected behavior
The expected behavior is to be able to filter by user ID even when "all" operations are selected.

Screenshots
don't have any

Desktop (please complete the following information):

• OS: Windows
• Browser: Edge
• Version: ?

Additional context

Solution:

I have tested the below and used the addition of where '{Operations:lable}'=='All' to get a populated user ID list even when the operations parameter is "all".

KQL expanded:

OfficeActivity
| where OfficeWorkload in ('OneDrive', 'SharePoint')
| where '{Operations:lable}'=='All' or Operation in ({Operations})
| summarize Count = count() by UserId
| order by Count desc, UserId asc
| project Value = UserId, Label = strcat(UserId, ' - ', Count)

JSON line:

OfficeActivity\r\n| where OfficeWorkload in ('OneDrive', 'SharePoint')\r\n| where '{Operations:lable}'=='All' or Operation in ({Operations})\r\n| summarize Count = count() by UserId\r\n| order by Count desc, UserId asc\r\n| project Value = UserId, Label = strcat(UserId, ' - ', Count)