Liongard Library

Welcome to Liongard Library, where Lions share! This is a community-led space where Liongard users can come to teach and learn from one another.
Share custom Metrics, get inspired and see what’s trending in the Pride.

Pride Etiquette:
➕ Have great custom Metrics? Add them as entries!
🌟 Want to use a Metric? Copy the query and follow this doc.
👍 Tried a Metric from the Library? Like it!
📣 Have a question or feedback on a Metric? Add a comment!
🔎 Not sure where to start? Learn about Metrics and how to write them.
💬 Need help writing a metric or want to help support others? Join the conversation in our Liongard Lounge #metrics slack channel.


🥴 See something off? Open a support chat to let us know.

ADD A NEW METRIC ENTRY

Microsoft 365

Showing 114 of 878

Microsoft 365 : Malicious Application Consent - PerfectData

This application has actively been used during account compromises to create a backup of the accounts mailbox.Create an actionable alert for this and audit all environments.
Devon about 1 year ago in Microsoft 365 1

Microsoft 365: Privileged User w/ License

Best Practices are for admin accounts to not contain a license unless required. This metric outputs Privileged users and what products they are assigned
Devon over 2 years ago in Microsoft 365 0

Microsoft 365: Users w/ Associated Licenses

This Metric is great for Reports (QBRs and Licensing Audits) and gaining and sharing granular visibility into user's licensing status.
Addison Caldwell almost 3 years ago in Microsoft 365 0

Microsoft 365: Mailbox Size Greater than XX

This will look for users with mailboxes larger than 45. Customize the value to change Metric. Output will include mailname and size of mailbox.
Devon about 2 years ago in Microsoft 365 2

[Microsoft 365: Non-Admin, Non-Guest, License Assigned, MFA disabled]

This query looks for non-admin users who have an active license within your organization that do not have MFA enabled (ignoring guest users).
Charles Van Duynhoven over 2 years ago in Microsoft 365 5

Microsoft 365: Exchange Licensed user w/ 95% full mailbox

Outputs percentage of Storage used against full mailbox size in addition to the email address and mailbox size. Microsoft's built in warning to the user is at 98%, Prohibits sending at 99%, and Prohibits receiving at 100%. This can be customized b...
Devon over 1 year ago in Microsoft 365 2

Microsoft 365: Percent of Storage Used over 90

Checks for Storage_Used existing, then any users with over 90% storage used, then prints the name and amount of storage used
Leland Shane about 2 years ago in Microsoft 365 0

Microsoft 365: Safe Attachments Enabled

Uses Microsoft 365 secure score to check if you meet the requirements for Safe Attachments. This means that the policies must be set to block. Provides True/False Response.
Jai Dametto over 2 years ago in Microsoft 365 0

Office 365: Admin Users with MFA Disabled List

This is helpful to someone who's trying to obtain/maintain visibility into the admin users in an organization's M365 instance. This is a good Metric for QBRs, recurring site reviews, and an onboarding report. Also, this Metric could be used to bui...
Addison Caldwell almost 3 years ago in Microsoft 365 2

M365: AAD App Secrets Expiring within 30 days

Looks for applications with expiring/expired secrets (within 30 days), then outputs the Application name, and the secrets associated that are expiring/expired.
Leland Shane about 1 year ago in Microsoft 365 0