New MPARR2 Templates - 400 error, bad request

jsawepiq commented 1 month ago

Hello:

We recently did a fresh install of MPARR2 on Win2019 and it appears everything is working order. All scheduled tasks are there, executing successfully and we have tables and data in the custom logs in our new Log Analytics Workplace. We tried using the new templates for MPARR2 located in the URLs below and none of them seem to work. We are getting a Web.Content Failed to get content for many of the queries. I have diagnostic turned on in the new LAW and these queries with a 400 error not event making to the designation (nothing logged). PowerBI templates for our MPARR1 deployment and our old LAW are working just fine on the same server. And yes, we are using the correct LAW id when testing MPARR2. Some queries do get through though with 200 query responses.

https://github.com/microsoft/Microsoft-Purview-Advanced-Rich-Reports-MPARR-Collector/blob/main/MPARR%20-%20Templates/Copilot/MPARR2%20-%20Copilot%20v1.pbit

https://github.com/microsoft/Microsoft-Purview-Advanced-Rich-Reports-MPARR-Collector/blob/main/MPARR%20-%20Templates/Information%20Protection/MPARR2%20-%20Sensitivity%20Labels.pbit

2024-03-23 09_47_23-VM03-WIN2019 - 172 190 122 23_3389 - Remote Desktop Connection 2024-03-23 09_47_41-VM03-WIN2019 - 172 190 122 23_3389 - Remote Desktop Connection 2024-03-23 09_58_02-VM03-WIN2019 - 172 190 122 23_3389 - Remote Desktop Connection

ProfKaz commented 1 month ago

Hi @jsawepiq,

That is a very common issue with Power BI are the templates, if it´s for any reason a field is not available all the reports fail, you need to go to Transform Data at the main menu, after the report crash, and in the new window pop-up at left you can go through all the queries and see which one of them are failing, please share the results.

jsawepiq commented 1 month ago

MPARR2 - Sensitivity Labels DataSource.Error: Web.Contents failed to get contents from 'https://api.loganalytics.io/v1/workspaces/4de42342-dec0-4eff-818b-b599195f4167/query?query=MicrosoftEntraUsers_CL%20%0A%7C%20where%20TimeGenerated%20%3E%3D%20now%28-30d%29%0A%7C%20summarize%20arg_max%28TimeGenerated%2C%20UserPrincipalName_s%2C%20DisplayName_s%2C%20AssignedLicenses_s%2C%20City_s%2C%20JobTitle_s%2C%20Department_s%2C%20Mail_s%2C%20OfficeLocation_s%2C%20Id_g%2C%20SignInActivity_lastSignInDateTime_t%2C%20Country_s%2C%20CompanyName_s%2C%20AssignedPlans_s%2C%20Computer%2C%20CreatedDateTime_t%2C%20State_s%2C%20Type%2C%20UserType_s%29%20by%20UserPrincipalName_s%0A%0A&x-ms-app=OmsAnalyticsPBI&prefer=ai.response-thinning%3Dtrue' (400): Bad Request Details: DataSourceKind=Web DataSourcePath=https://api.loganalytics.io/v1/workspaces/4de42342-dec0-4eff-818b-b599195f4167/query Url=https://api.loganalytics.io/v1/workspaces/4de42342-dec0-4eff-818b-b599195f4167/query?query=MicrosoftEntraUsers_CL%20%0A%7C%20where%20TimeGenerated%20%3E%3D%20now%28-30d%29%0A%7C%20summarize%20arg_max%28TimeGenerated%2C%20UserPrincipalName_s%2C%20DisplayName_s%2C%20AssignedLicenses_s%2C%20City_s%2C%20JobTitle_s%2C%20Department_s%2C%20Mail_s%2C%20OfficeLocation_s%2C%20Id_g%2C%20SignInActivity_lastSignInDateTime_t%2C%20Country_s%2C%20CompanyName_s%2C%20AssignedPlans_s%2C%20Computer%2C%20CreatedDateTime_t%2C%20State_s%2C%20Type%2C%20UserType_s%29%20by%20UserPrincipalName_s%0A%0A&x-ms-app=OmsAnalyticsPBI&prefer=ai.response-thinning%3Dtrue

PindaRotz commented 1 month ago

Not sure if it's the same thing, but I've experienced a similar thing with the template. If you open the Advanced Editor you can see the query which is being triggered. Copy paste that query in your Log Analytics environment and you might see what the exact error is. In my case I saw that there were 2 columns missing (Country_s and State_s).

ProfKaz commented 1 month ago

Not sure if it's the same thing, but I've experienced a similar thing with the template. If you open the Advanced Editor you can see the query which is being triggered. Copy paste that query in your Log Analytics environment and you might see what the exact error is. In my case I saw that there were 2 columns missing (Country_s and State_s).

The big deal based on the image is that you are not using the attributes Country and State in your users, the most simple way to resolve to avoid make changes on the Power BI reports, is add at least to one user those attributes, then validate inside of the folder ConfigFiles on your MPARR installation, on the file MPARR-MicrosoftEntraUsers.json if those attributes are set to True and then run the MPARR-MicrosoftEntraUsers.ps1 script again.

ProfKaz commented 1 month ago

MPARR2 - Copilot v1 DataSource.Error: Web.Contents failed to get contents from 'https://api.loganalytics.io/v1/workspaces/4de42342-dec0-4eff-818b-b599195f4167/query?query=AuditGeneral_CL%0A%7C%20where%20Operation_s%20contains%20%22CopilotInteraction%22%0A%7C%20project%20%0A%20%20%20%20TimeGenerated%2C%0A%20%20%20%20CopilotEventData_AccessedResources_s%2C%0A%20%20%20%20CopilotEventData_AppHost_s%2C%0A%20%20%20%20CopilotEventData_Contexts_s%2C%0A%20%20%20%20CopilotEventData_MessageIds_s%2C%0A%20%20%20%20CopilotEventData_ThreadId_s%2C%0A%20%20%20%20UserId_s%2C%0A%20%20%20%20ClientIP_s%2C%0A%20%20%20%20Id_g%2C%0A%20%20%20%20RecordType_d%2C%0A%20%20%20%20Operation_s%2C%0A%20%20%20%20OrganizationId_g%2C%0A%20%20%20%20UserType_d%2C%0A%20%20%20%20UserKey_g%2C%0A%20%20%20%20Workload_s%2C%0A%20%20%20%20EventCreationTime_t%0A%20%20%20%0A&x-ms-app=OmsAnalyticsPBI&timespan=P1D&prefer=ai.response-thinning%3Dtrue' (400): Bad Request Details: DataSourceKind=Web DataSourcePath=https://api.loganalytics.io/v1/workspaces/4de42342-dec0-4eff-818b-b599195f4167/query Url=https://api.loganalytics.io/v1/workspaces/4de42342-dec0-4eff-818b-b599195f4167/query?query=AuditGeneral_CL%0A%7C%20where%20Operation_s%20contains%20%22CopilotInteraction%22%0A%7C%20project%20%0A%20%20%20%20TimeGenerated%2C%0A%20%20%20%20CopilotEventData_AccessedResources_s%2C%0A%20%20%20%20CopilotEventData_AppHost_s%2C%0A%20%20%20%20CopilotEventData_Contexts_s%2C%0A%20%20%20%20CopilotEventData_MessageIds_s%2C%0A%20%20%20%20CopilotEventData_ThreadId_s%2C%0A%20%20%20%20UserId_s%2C%0A%20%20%20%20ClientIP_s%2C%0A%20%20%20%20Id_g%2C%0A%20%20%20%20RecordType_d%2C%0A%20%20%20%20Operation_s%2C%0A%20%20%20%20OrganizationId_g%2C%0A%20%20%20%20UserType_d%2C%0A%20%20%20%20UserKey_g%2C%0A%20%20%20%20Workload_s%2C%0A%20%20%20%20EventCreationTime_t%0A%20%20%20%0A&x-ms-app=OmsAnalyticsPBI&timespan=P1D&prefer=ai.response-thinning%3Dtrue

MPARR2 - Sensitivity Labels DataSource.Error: Web.Contents failed to get contents from 'https://api.loganalytics.io/v1/workspaces/4de42342-dec0-4eff-818b-b599195f4167/query?query=MicrosoftEntraUsers_CL%20%0A%7C%20where%20TimeGenerated%20%3E%3D%20now%28-30d%29%0A%7C%20summarize%20arg_max%28TimeGenerated%2C%20UserPrincipalName_s%2C%20DisplayName_s%2C%20AssignedLicenses_s%2C%20City_s%2C%20JobTitle_s%2C%20Department_s%2C%20Mail_s%2C%20OfficeLocation_s%2C%20Id_g%2C%20SignInActivity_lastSignInDateTime_t%2C%20Country_s%2C%20CompanyName_s%2C%20AssignedPlans_s%2C%20Computer%2C%20CreatedDateTime_t%2C%20State_s%2C%20Type%2C%20UserType_s%29%20by%20UserPrincipalName_s%0A%0A&x-ms-app=OmsAnalyticsPBI&prefer=ai.response-thinning%3Dtrue' (400): Bad Request Details: DataSourceKind=Web DataSourcePath=https://api.loganalytics.io/v1/workspaces/4de42342-dec0-4eff-818b-b599195f4167/query Url=https://api.loganalytics.io/v1/workspaces/4de42342-dec0-4eff-818b-b599195f4167/query?query=MicrosoftEntraUsers_CL%20%0A%7C%20where%20TimeGenerated%20%3E%3D%20now%28-30d%29%0A%7C%20summarize%20arg_max%28TimeGenerated%2C%20UserPrincipalName_s%2C%20DisplayName_s%2C%20AssignedLicenses_s%2C%20City_s%2C%20JobTitle_s%2C%20Department_s%2C%20Mail_s%2C%20OfficeLocation_s%2C%20Id_g%2C%20SignInActivity_lastSignInDateTime_t%2C%20Country_s%2C%20CompanyName_s%2C%20AssignedPlans_s%2C%20Computer%2C%20CreatedDateTime_t%2C%20State_s%2C%20Type%2C%20UserType_s%29%20by%20UserPrincipalName_s%0A%0A&x-ms-app=OmsAnalyticsPBI&prefer=ai.response-thinning%3Dtrue

The error can be very common if you don´t have certain attributes, you can go to Transform Data and see the queries on the left and see which one of them is having issues and identify the fields that are missing.

microsoft / Microsoft-Purview-Advanced-Rich-Reports-MPARR-Collector

New MPARR2 Templates - 400 error, bad request #56