What is the significance of Pull Time in an event?

Microsoft may sometimes experience delays in reporting events through its API. While the "Date" field indicates the actual event occurrence, the "Pull Time" reflects when SaaS Alerts received and processed this information. These delays, though infrequent, can arise from Microsoft's system processes like load balancing and data dissemination.

Please note that SaaS Alerts cannot influence the timing of Microsoft's event reporting. We promptly process and deliver these events as soon as they are received via the API. You can verify this by examining the "Pull Time" in the Analysis module.

Saas Alerts subscribes to webhooks for data collection whenever possible. When this is not possible or advisable, SaaS Alerts systems poll for data every 15 minutes for each Organization. Since many products (In particular M365) have data query limits, SaaS Alerts employs multiple techniques to ensure that data queries do not exceed these limits. Other third-party tools may exceed these query limits for an individual tenant. When that occurs SaaS Alerts will automatically re-query for requested data according to the "retry-value" that is returned if the regularly timed query is returned with no-data. Partners should be cognizant and cautious about using multiple tools that repeatedly query for data from the graph API; this can lead to data retrieval slowdowns imposed by M365 graph API limits.