diff --git a/Azure Services/Power Platform/Connectors/Queries/Analytics/Custom vs standard breakdown.kql b/Azure Services/Power Platform/Connectors/Queries/Analytics/Custom vs standard breakdown.kql
new file mode 100644
index 00000000..e6a613e8
--- /dev/null
+++ b/Azure Services/Power Platform/Connectors/Queries/Analytics/Custom vs standard breakdown.kql	
@@ -0,0 +1,13 @@
+// Author: russrimm
+// Display name: Connectors - Custom vs Standard Breakdown
+// Description: Compare usage of custom connectors against standard/premium connectors
+// Categories: Power Platform
+// Resource types: Power Platform Connectors
+// Topic: Governance
+// Prerequisites: Power Platform admin diagnostic settings connected to Log Analytics workspace
+
+PowerPlatformConnectorActivity
+| where TimeGenerated > ago(30d)
+| extend ConnectorType = iff(ConnectorId startswith "shared_", "Standard/Premium", "Custom")
+| summarize Calls=count(), UniqueUsers=dcount(UserId) by ConnectorType, ConnectorId
+| order by Calls desc
diff --git a/Azure Services/Power Platform/Connectors/Queries/Analytics/Failures and throttling.kql b/Azure Services/Power Platform/Connectors/Queries/Analytics/Failures and throttling.kql
new file mode 100644
index 00000000..473c2634
--- /dev/null
+++ b/Azure Services/Power Platform/Connectors/Queries/Analytics/Failures and throttling.kql	
@@ -0,0 +1,14 @@
+// Author: russrimm
+// Display name: Connectors - Failures and Throttling
+// Description: Failed connector calls and throttled requests with error details
+// Categories: Power Platform
+// Resource types: Power Platform Connectors
+// Topic: Troubleshooting
+// Prerequisites: Power Platform admin diagnostic settings connected to Log Analytics workspace
+
+PowerPlatformConnectorActivity
+| where TimeGenerated > ago(7d)
+| where ResultStatus == "Failure" or ResultStatus == "Throttled"
+| project TimeGenerated, ConnectorId, OperationName, ResultStatus, ErrorMessage=tostring(AdditionalInfo), UserId
+| order by TimeGenerated desc
+| take 100
diff --git a/Azure Services/Power Platform/Connectors/Queries/Analytics/Top 20 most used connectors.kql b/Azure Services/Power Platform/Connectors/Queries/Analytics/Top 20 most used connectors.kql
new file mode 100644
index 00000000..e49d760d
--- /dev/null
+++ b/Azure Services/Power Platform/Connectors/Queries/Analytics/Top 20 most used connectors.kql	
@@ -0,0 +1,13 @@
+// Author: russrimm
+// Display name: Connectors - Top 20 Most Used Connectors
+// Description: Highest-volume connectors by invocation count
+// Categories: Power Platform
+// Resource types: Power Platform Connectors
+// Topic: Usage Analytics
+// Prerequisites: Power Platform admin diagnostic settings connected to Log Analytics workspace
+
+PowerPlatformConnectorActivity
+| where TimeGenerated > ago(30d)
+| summarize Calls=count(), UniqueUsers=dcount(UserId) by ConnectorId
+| order by Calls desc
+| take 20
diff --git a/Azure Services/Power Platform/Connectors/Queries/Analytics/Usage summary by day.kql b/Azure Services/Power Platform/Connectors/Queries/Analytics/Usage summary by day.kql
new file mode 100644
index 00000000..10674221
--- /dev/null
+++ b/Azure Services/Power Platform/Connectors/Queries/Analytics/Usage summary by day.kql	
@@ -0,0 +1,12 @@
+// Author: russrimm
+// Display name: Connectors - Usage Summary by Day
+// Description: Daily connector invocation counts and distinct users
+// Categories: Power Platform
+// Resource types: Power Platform Connectors
+// Topic: Usage Analytics
+// Prerequisites: Power Platform admin diagnostic settings connected to Log Analytics workspace
+
+PowerPlatformConnectorActivity
+| where TimeGenerated > ago(30d)
+| summarize Calls=count(), UniqueUsers=dcount(UserId) by Day=bin(TimeGenerated, 1d)
+| order by Day asc
diff --git a/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/30-day session summary.kql b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/30-day session summary.kql
new file mode 100644
index 00000000..f6f63c5c
--- /dev/null
+++ b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/30-day session summary.kql	
@@ -0,0 +1,20 @@
+// Author: russrimm
+// Display name: Copilot Studio - 30-Day Session Summary
+// Description: Total sessions, messages, topics triggered, and error count over the last 30 days
+// Categories: Power Platform
+// Resource types: Copilot Studio
+// Topic: Usage Analytics
+
+union isfuzzy=true (AppCustomEvents
+| where TimeGenerated > ago(30d)
+| where Properties["designMode"] != "True"
+| summarize
+    TotalSessions=dcount(tostring(Properties["conversationId"])),
+    MessagesReceived=countif(Name=="BotMessageReceived"),
+    MessagesSent=countif(Name=="BotMessageSend"),
+    TopicsStarted=countif(Name=="DialogStart"),
+    TopicsCompleted=countif(Name=="DialogComplete"),
+    GenerativeAnswered=countif(Name=="GenerativeAnswerResult" and tobool(Properties["hasAnswer"])==true),
+    DialogErrors=countif(Name in ("DialogFail","WaterfallFail"))
+| extend CompletionRate=round(todouble(TopicsCompleted)/todouble(TopicsStarted)*100, 1)
+| project TotalSessions, MessagesReceived, MessagesSent, TopicsStarted, TopicsCompleted, CompletionRate, GenerativeAnswered, DialogErrors)
diff --git a/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Action and plugin call traces.kql b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Action and plugin call traces.kql
new file mode 100644
index 00000000..69478128
--- /dev/null
+++ b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Action and plugin call traces.kql	
@@ -0,0 +1,13 @@
+// Author: russrimm
+// Display name: Copilot Studio - Action and Plugin Call Traces
+// Description: Power Automate flow calls and HTTP action traces from bot conversations
+// Categories: Power Platform
+// Resource types: Copilot Studio
+// Topic: Troubleshooting
+
+union isfuzzy=true (AppTraces
+| where TimeGenerated > ago(7d)
+| where Message has_any ("PowerAutomate", "HttpAction", "SkillAction", "ActionResult", "PluginAction")
+| project TimeGenerated, Message, SeverityLevel, Properties
+| order by TimeGenerated desc
+| take 100)
diff --git a/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Action errors in traces.kql b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Action errors in traces.kql
new file mode 100644
index 00000000..609c9b0c
--- /dev/null
+++ b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Action errors in traces.kql	
@@ -0,0 +1,14 @@
+// Author: russrimm
+// Display name: Copilot Studio - Action Errors in Traces
+// Description: Failed action or plugin calls captured in AppTraces during bot conversations
+// Categories: Power Platform
+// Resource types: Copilot Studio
+// Topic: Troubleshooting
+
+union isfuzzy=true (AppTraces
+| where TimeGenerated > ago(7d)
+| where SeverityLevel >= 2
+| where Message has_any ("PowerAutomate", "HttpAction", "SkillAction", "ActionResult", "PluginAction", "connector", "action")
+| project TimeGenerated, SeverityLevel, Message, Properties
+| order by TimeGenerated desc
+| take 50)
diff --git a/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Admin activity publish configure delete.kql b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Admin activity publish configure delete.kql
new file mode 100644
index 00000000..228eb18a
--- /dev/null
+++ b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Admin activity publish configure delete.kql	
@@ -0,0 +1,14 @@
+// Author: russrimm
+// Display name: Copilot Studio - Admin Activity (Publish, Configure, Delete)
+// Description: Bot publish, configuration changes, and deletions from PowerPlatformAdminActivity
+// Categories: Power Platform
+// Resource types: Copilot Studio
+// Topic: Governance
+// Prerequisites: Power Platform admin activity logs connected to Log Analytics workspace
+
+union isfuzzy=true (PowerPlatformAdminActivity
+| where TimeGenerated > ago(30d)
+| where EntityType == "Bot"
+| project TimeGenerated, Operation, EntityName, ResultStatus, UserId, UserName
+| order by TimeGenerated desc
+| take 100)
diff --git a/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Admin operation summary.kql b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Admin operation summary.kql
new file mode 100644
index 00000000..074f9387
--- /dev/null
+++ b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Admin operation summary.kql	
@@ -0,0 +1,13 @@
+// Author: russrimm
+// Display name: Copilot Studio - Admin Operation Summary
+// Description: Count of bot admin operations by type over the last 30 days
+// Categories: Power Platform
+// Resource types: Copilot Studio
+// Topic: Governance
+// Prerequisites: Power Platform admin activity logs connected to Log Analytics workspace
+
+union isfuzzy=true (PowerPlatformAdminActivity
+| where TimeGenerated > ago(30d)
+| where EntityType == "Bot"
+| summarize Count=count(), SuccessCount=countif(ResultStatus=="Succeeded"), FailCount=countif(ResultStatus=="Failed") by Operation
+| order by Count desc)
diff --git a/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Bot conversation errors BotConversationEvent.kql b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Bot conversation errors BotConversationEvent.kql
new file mode 100644
index 00000000..65a08c2f
--- /dev/null
+++ b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Bot conversation errors BotConversationEvent.kql	
@@ -0,0 +1,14 @@
+// Author: russrimm
+// Display name: Copilot Studio - Bot Conversation Errors (BotConversationEvent)
+// Description: Error events in conversations from BotConversationEvent with error code and message
+// Categories: Power Platform
+// Resource types: Copilot Studio
+// Topic: Troubleshooting
+// Prerequisites: Power Platform diagnostic settings connected to Log Analytics workspace
+
+union isfuzzy=true (BotConversationEvent
+| where TimeGenerated > ago(7d)
+| where isnotempty(ErrorCode) or Outcome == "Failure"
+| project TimeGenerated, BotId, Channel, DialogId, Outcome, ErrorCode, ErrorMessage, ConversationId
+| order by TimeGenerated desc
+| take 100)
diff --git a/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Bot conversations BotConversationEvent.kql b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Bot conversations BotConversationEvent.kql
new file mode 100644
index 00000000..00495b0c
--- /dev/null
+++ b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Bot conversations BotConversationEvent.kql	
@@ -0,0 +1,15 @@
+// Author: russrimm
+// Display name: Copilot Studio - Bot Conversations (BotConversationEvent)
+// Description: All conversation events from the native Power Platform BotConversationEvent table
+// Categories: Power Platform
+// Resource types: Copilot Studio
+// Topic: Usage Analytics
+// Prerequisites: Power Platform diagnostic settings connected to Log Analytics workspace
+
+union isfuzzy=true (BotConversationEvent
+| where TimeGenerated > ago(7d)
+| summarize
+    Sessions=dcount(ConversationId),
+    Events=count()
+    by Day=bin(TimeGenerated, 1d), Channel
+| order by Day asc)
diff --git a/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Channel activity BotConversationEvent.kql b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Channel activity BotConversationEvent.kql
new file mode 100644
index 00000000..792a0bee
--- /dev/null
+++ b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Channel activity BotConversationEvent.kql	
@@ -0,0 +1,12 @@
+// Author: russrimm
+// Display name: Copilot Studio - Channel Activity (BotConversationEvent)
+// Description: Sessions per channel per day from BotConversationEvent
+// Categories: Power Platform
+// Resource types: Copilot Studio
+// Topic: Usage Analytics
+// Prerequisites: Power Platform diagnostic settings connected to Log Analytics workspace
+
+union isfuzzy=true (BotConversationEvent
+| where TimeGenerated > ago(30d)
+| summarize Sessions=dcount(ConversationId) by Day=bin(TimeGenerated, 1d), Channel
+| order by Day asc)
diff --git a/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Channel breakdown.kql b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Channel breakdown.kql
new file mode 100644
index 00000000..4a77c71a
--- /dev/null
+++ b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Channel breakdown.kql	
@@ -0,0 +1,13 @@
+// Author: russrimm
+// Display name: Copilot Studio - Channel Breakdown
+// Description: Message volume by publishing channel, excluding test canvas
+// Categories: Power Platform
+// Resource types: Copilot Studio
+// Topic: Usage Analytics
+
+union isfuzzy=true (AppCustomEvents
+| where TimeGenerated > ago(30d)
+| where Properties["designMode"] != "True"
+| where Name == "BotMessageReceived"
+| summarize Messages=count() by Channel=tostring(Properties["channelId"])
+| order by Messages desc)
diff --git a/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Conversation outcomes BotConversationEvent.kql b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Conversation outcomes BotConversationEvent.kql
new file mode 100644
index 00000000..63dc5103
--- /dev/null
+++ b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Conversation outcomes BotConversationEvent.kql	
@@ -0,0 +1,12 @@
+// Author: russrimm
+// Display name: Copilot Studio - Conversation Outcomes (BotConversationEvent)
+// Description: Resolved, escalated, and abandoned conversation counts from BotConversationEvent
+// Categories: Power Platform
+// Resource types: Copilot Studio
+// Topic: Usage Analytics
+// Prerequisites: Power Platform diagnostic settings connected to Log Analytics workspace
+
+union isfuzzy=true (BotConversationEvent
+| where TimeGenerated > ago(30d)
+| summarize ConversationCount=dcount(ConversationId) by Outcome, Channel
+| order by ConversationCount desc)
diff --git a/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Daily session volume.kql b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Daily session volume.kql
new file mode 100644
index 00000000..79ef9af7
--- /dev/null
+++ b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Daily session volume.kql	
@@ -0,0 +1,12 @@
+// Author: russrimm
+// Display name: Copilot Studio - Daily Session Volume
+// Description: Unique conversation sessions per day, excluding test canvas
+// Categories: Power Platform
+// Resource types: Copilot Studio
+// Topic: Usage Analytics
+
+union isfuzzy=true (AppCustomEvents
+| where TimeGenerated > ago(30d)
+| where Properties["designMode"] != "True"
+| summarize Sessions=dcount(tostring(Properties["conversationId"])) by Day=bin(TimeGenerated, 1d)
+| order by Day asc)
diff --git a/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Dialog errors.kql b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Dialog errors.kql
new file mode 100644
index 00000000..25479e3e
--- /dev/null
+++ b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Dialog errors.kql	
@@ -0,0 +1,13 @@
+// Author: russrimm
+// Display name: Copilot Studio - Dialog Errors
+// Description: Failed dialogs and waterfall step failures per day
+// Categories: Power Platform
+// Resource types: Copilot Studio
+// Topic: Troubleshooting
+
+union isfuzzy=true (AppCustomEvents
+| where TimeGenerated > ago(30d)
+| where Properties["designMode"] != "True"
+| where Name in ("DialogFail", "WaterfallFail")
+| summarize Errors=count() by Day=bin(TimeGenerated, 1d), ErrorType=Name
+| order by Day asc)
diff --git a/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Escalations to human.kql b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Escalations to human.kql
new file mode 100644
index 00000000..846d1685
--- /dev/null
+++ b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Escalations to human.kql	
@@ -0,0 +1,16 @@
+// Author: russrimm
+// Display name: Copilot Studio - Escalations to Human
+// Description: Daily count of topics that escalated to a human agent
+// Categories: Power Platform
+// Resource types: Copilot Studio
+// Topic: Usage Analytics
+
+union isfuzzy=true (AppCustomEvents
+| where TimeGenerated > ago(30d)
+| where Properties["designMode"] != "True"
+| where Name == "DialogStart"
+| where tolower(tostring(Properties["dialogName"])) contains "escalat"
+    or tolower(tostring(Properties["dialogName"])) contains "human"
+    or tolower(tostring(Properties["dialogName"])) contains "agent"
+| summarize Count=count() by Day=bin(TimeGenerated, 1d)
+| order by Day asc)
diff --git a/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Generative AI answer rate.kql b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Generative AI answer rate.kql
new file mode 100644
index 00000000..02ee9f95
--- /dev/null
+++ b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Generative AI answer rate.kql	
@@ -0,0 +1,18 @@
+// Author: russrimm
+// Display name: Copilot Studio - Generative AI Answer Rate
+// Description: Daily generative answer rate and average confidence, excluding test canvas
+// Categories: Power Platform
+// Resource types: Copilot Studio
+// Topic: Usage Analytics
+
+union isfuzzy=true (AppCustomEvents
+| where TimeGenerated > ago(30d)
+| where Properties["designMode"] != "True"
+| where Name == "GenerativeAnswerResult"
+| summarize
+    Total=count(),
+    Answered=countif(tobool(Properties["hasAnswer"])==true),
+    AvgConfidence=round(avg(todouble(Properties["confidence"])), 2)
+    by Day=bin(TimeGenerated, 1d)
+| extend AnswerRate=round(todouble(Answered)/todouble(Total)*100, 1)
+| order by Day asc)
diff --git a/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Message volume received vs sent.kql b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Message volume received vs sent.kql
new file mode 100644
index 00000000..3233ce4a
--- /dev/null
+++ b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Message volume received vs sent.kql	
@@ -0,0 +1,13 @@
+// Author: russrimm
+// Display name: Copilot Studio - Message Volume (Received vs Sent)
+// Description: User messages received vs bot messages sent per day, excluding test canvas
+// Categories: Power Platform
+// Resource types: Copilot Studio
+// Topic: Usage Analytics
+
+union isfuzzy=true (AppCustomEvents
+| where TimeGenerated > ago(30d)
+| where Properties["designMode"] != "True"
+| where Name in ("BotMessageReceived", "BotMessageSend")
+| summarize Received=countif(Name=="BotMessageReceived"), Sent=countif(Name=="BotMessageSend") by Day=bin(TimeGenerated, 1d)
+| order by Day asc)
diff --git a/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Recent session detail BotConversationEvent.kql b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Recent session detail BotConversationEvent.kql
new file mode 100644
index 00000000..f3c4166d
--- /dev/null
+++ b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Recent session detail BotConversationEvent.kql	
@@ -0,0 +1,13 @@
+// Author: russrimm
+// Display name: Copilot Studio - Recent Session Detail (BotConversationEvent)
+// Description: Latest 100 bot conversation events for live debugging
+// Categories: Power Platform
+// Resource types: Copilot Studio
+// Topic: Troubleshooting
+// Prerequisites: Power Platform diagnostic settings connected to Log Analytics workspace
+
+union isfuzzy=true (BotConversationEvent
+| where TimeGenerated > ago(1d)
+| project TimeGenerated, Channel, DialogId, ActivityType, Outcome, ErrorCode, ConversationId, SessionId
+| order by TimeGenerated desc
+| take 100)
diff --git a/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Test canvas activity.kql b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Test canvas activity.kql
new file mode 100644
index 00000000..36e5c824
--- /dev/null
+++ b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Test canvas activity.kql	
@@ -0,0 +1,12 @@
+// Author: russrimm
+// Display name: Copilot Studio - Test Canvas Activity
+// Description: All bot activity from the Copilot Studio test canvas (author testing sessions only)
+// Categories: Power Platform
+// Resource types: Copilot Studio
+// Topic: Testing
+
+union isfuzzy=true (AppCustomEvents
+| where TimeGenerated > ago(7d)
+| where Properties["designMode"] == "True"
+| summarize Events=count(), UniqueTopics=dcount(tostring(Properties["dialogName"])) by Day=bin(TimeGenerated, 1d)
+| order by Day asc)
diff --git a/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Test canvas errors.kql b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Test canvas errors.kql
new file mode 100644
index 00000000..6634767f
--- /dev/null
+++ b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Test canvas errors.kql	
@@ -0,0 +1,20 @@
+// Author: russrimm
+// Display name: Copilot Studio - Test Canvas Errors
+// Description: Dialog failures and errors encountered during test canvas sessions
+// Categories: Power Platform
+// Resource types: Copilot Studio
+// Topic: Testing
+
+union isfuzzy=true (AppCustomEvents
+| where TimeGenerated > ago(7d)
+| where Properties["designMode"] == "True"
+| where Name in ("DialogFail", "WaterfallFail", "GenerativeAnswerResult")
+| extend IsError = Name in ("DialogFail", "WaterfallFail")
+| extend NoAnswer = Name == "GenerativeAnswerResult" and tobool(Properties["hasAnswer"]) == false
+| where IsError or NoAnswer
+| project TimeGenerated,
+    EventType = Name,
+    Topic = tostring(Properties["dialogName"]),
+    ConversationId = tostring(Properties["conversationId"])
+| order by TimeGenerated desc
+| take 50)
diff --git a/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Test canvas topic coverage.kql b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Test canvas topic coverage.kql
new file mode 100644
index 00000000..3ad962a9
--- /dev/null
+++ b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Test canvas topic coverage.kql	
@@ -0,0 +1,17 @@
+// Author: russrimm
+// Display name: Copilot Studio - Test Canvas Topic Coverage
+// Description: Topics exercised during test canvas sessions - useful to verify test coverage
+// Categories: Power Platform
+// Resource types: Copilot Studio
+// Topic: Testing
+
+union isfuzzy=true (AppCustomEvents
+| where TimeGenerated > ago(7d)
+| where Properties["designMode"] == "True"
+| where Name == "DialogStart"
+| summarize
+    Triggered=count(),
+    Completed=countif(Name=="DialogComplete"),
+    LastTested=max(TimeGenerated)
+    by Topic=tostring(Properties["dialogName"])
+| order by LastTested desc)
diff --git a/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Test vs production traffic.kql b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Test vs production traffic.kql
new file mode 100644
index 00000000..d9f45d69
--- /dev/null
+++ b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Test vs production traffic.kql	
@@ -0,0 +1,13 @@
+// Author: russrimm
+// Display name: Copilot Studio - Test vs Production Traffic
+// Description: Compare event counts from test canvas vs real users per day
+// Categories: Power Platform
+// Resource types: Copilot Studio
+// Topic: Testing
+
+union isfuzzy=true (AppCustomEvents
+| where TimeGenerated > ago(14d)
+| where Name == "BotMessageReceived"
+| extend TrafficType = iff(tostring(Properties["designMode"]) == "True", "Test Canvas", "Production")
+| summarize Messages=count() by Day=bin(TimeGenerated, 1d), TrafficType
+| order by Day asc)
diff --git a/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Top 15 topics.kql b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Top 15 topics.kql
new file mode 100644
index 00000000..93926178
--- /dev/null
+++ b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Top 15 topics.kql	
@@ -0,0 +1,14 @@
+// Author: russrimm
+// Display name: Copilot Studio - Top 15 Topics
+// Description: Most frequently triggered dialog topics, excluding test canvas
+// Categories: Power Platform
+// Resource types: Copilot Studio
+// Topic: Usage Analytics
+
+union isfuzzy=true (AppCustomEvents
+| where TimeGenerated > ago(30d)
+| where Properties["designMode"] != "True"
+| where Name == "DialogStart"
+| summarize Triggers=count() by Topic=tostring(Properties["dialogName"])
+| order by Triggers desc
+| take 15)
diff --git a/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Top topics by outcome BotConversationEvent.kql b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Top topics by outcome BotConversationEvent.kql
new file mode 100644
index 00000000..05c5fd4f
--- /dev/null
+++ b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Top topics by outcome BotConversationEvent.kql	
@@ -0,0 +1,20 @@
+// Author: russrimm
+// Display name: Copilot Studio - Top Topics by Outcome (BotConversationEvent)
+// Description: Most-triggered dialog topics broken down by outcome
+// Categories: Power Platform
+// Resource types: Copilot Studio
+// Topic: Usage Analytics
+// Prerequisites: Power Platform diagnostic settings connected to Log Analytics workspace
+
+union isfuzzy=true (BotConversationEvent
+| where TimeGenerated > ago(30d)
+| summarize
+    Total=count(),
+    Resolved=countif(Outcome == "Success"),
+    Escalated=countif(Outcome == "Escalated"),
+    Failed=countif(Outcome == "Failure")
+    by Topic=DialogId
+| where Total > 0
+| extend ResolutionRate=round(todouble(Resolved)/todouble(Total)*100, 1)
+| order by Total desc
+| take 20)
diff --git a/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Topic abandonment.kql b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Topic abandonment.kql
new file mode 100644
index 00000000..3992020c
--- /dev/null
+++ b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Topic abandonment.kql	
@@ -0,0 +1,25 @@
+// Author: russrimm
+// Display name: Copilot Studio - Topic Abandonment
+// Description: Topics that were started but never completed or cancelled - proxy for abandonment
+// Categories: Power Platform
+// Resource types: Copilot Studio
+// Topic: Usage Analytics
+
+let started = materialize(union isfuzzy=true (AppCustomEvents
+| where TimeGenerated > ago(30d)
+| where Properties["designMode"] != "True"
+| where Name == "DialogStart"
+| summarize Started=count() by Topic=tostring(Properties["dialogName"])));
+let ended = materialize(union isfuzzy=true (AppCustomEvents
+| where TimeGenerated > ago(30d)
+| where Properties["designMode"] != "True"
+| where Name in ("DialogComplete", "DialogCancel", "DialogFail")
+| summarize Ended=count() by Topic=tostring(Properties["dialogName"])));
+started
+| join kind=leftouter ended on Topic
+| extend Ended=coalesce(Ended, 0)
+| extend Abandoned=Started - Ended
+| extend AbandonRate=round(todouble(Abandoned)/todouble(Started)*100, 1)
+| where Started > 5
+| order by AbandonRate desc
+| take 20
diff --git a/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Topic completion rates.kql b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Topic completion rates.kql
new file mode 100644
index 00000000..f5cfa5b5
--- /dev/null
+++ b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Topic completion rates.kql	
@@ -0,0 +1,21 @@
+// Author: russrimm
+// Display name: Copilot Studio - Topic Completion Rates
+// Description: Started, completed, cancelled, and failed counts per topic with completion percentage
+// Categories: Power Platform
+// Resource types: Copilot Studio
+// Topic: Usage Analytics
+
+union isfuzzy=true (AppCustomEvents
+| where TimeGenerated > ago(30d)
+| where Properties["designMode"] != "True"
+| where Name in ("DialogStart", "DialogComplete", "DialogCancel", "DialogFail")
+| summarize
+    Started=countif(Name=="DialogStart"),
+    Completed=countif(Name=="DialogComplete"),
+    Cancelled=countif(Name=="DialogCancel"),
+    Failed=countif(Name=="DialogFail")
+    by Topic=tostring(Properties["dialogName"])
+| where Started > 0
+| extend CompletionRate=round(todouble(Completed)/todouble(Started)*100, 1)
+| order by Started desc
+| take 20)
diff --git a/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Unrecognized inputs no answer.kql b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Unrecognized inputs no answer.kql
new file mode 100644
index 00000000..d2b463bd
--- /dev/null
+++ b/Azure Services/Power Platform/Copilot Studio/Queries/Analytics/Unrecognized inputs no answer.kql	
@@ -0,0 +1,14 @@
+// Author: russrimm
+// Display name: Copilot Studio - Unrecognized Inputs (No Answer)
+// Description: Generative AI queries where no answer was returned, by day
+// Categories: Power Platform
+// Resource types: Copilot Studio
+// Topic: Troubleshooting
+
+union isfuzzy=true (AppCustomEvents
+| where TimeGenerated > ago(30d)
+| where Properties["designMode"] != "True"
+| where Name == "GenerativeAnswerResult"
+| where tobool(Properties["hasAnswer"]) == false
+| summarize Count=count() by Day=bin(TimeGenerated, 1d)
+| order by Day asc)
diff --git a/Azure Services/Power Platform/DLP/Queries/Analytics/Blocked operations.kql b/Azure Services/Power Platform/DLP/Queries/Analytics/Blocked operations.kql
new file mode 100644
index 00000000..873b54ab
--- /dev/null
+++ b/Azure Services/Power Platform/DLP/Queries/Analytics/Blocked operations.kql	
@@ -0,0 +1,14 @@
+// Author: russrimm
+// Display name: DLP - Blocked Operations
+// Description: Operations blocked by DLP policies with details
+// Categories: Power Platform
+// Resource types: Power Platform DLP
+// Topic: Security
+// Prerequisites: Power Platform admin diagnostic settings connected to Log Analytics workspace
+
+PowerPlatformDlpActivity
+| where TimeGenerated > ago(7d)
+| where ResultStatus == "Blocked" or EventType has "Block"
+| project TimeGenerated, EventType, ConnectorId, PolicyName=tostring(AdditionalInfo), UserId
+| order by TimeGenerated desc
+| take 100
diff --git a/Azure Services/Power Platform/DLP/Queries/Analytics/Policy changes audit.kql b/Azure Services/Power Platform/DLP/Queries/Analytics/Policy changes audit.kql
new file mode 100644
index 00000000..174b578c
--- /dev/null
+++ b/Azure Services/Power Platform/DLP/Queries/Analytics/Policy changes audit.kql	
@@ -0,0 +1,14 @@
+// Author: russrimm
+// Display name: DLP - Policy Changes Audit
+// Description: DLP policy create, update, and delete operations
+// Categories: Power Platform
+// Resource types: Power Platform DLP
+// Topic: Governance
+// Prerequisites: Power Platform admin diagnostic settings connected to Log Analytics workspace
+
+PowerPlatformDlpActivity
+| where TimeGenerated > ago(30d)
+| where EventType has_any ("PolicyCreate", "PolicyUpdate", "PolicyDelete", "Create", "Update", "Delete")
+| project TimeGenerated, EventType, PolicyName=tostring(AdditionalInfo), UserId, ResultStatus
+| order by TimeGenerated desc
+| take 100
diff --git a/Azure Services/Power Platform/DLP/Queries/Analytics/Policy violations over time.kql b/Azure Services/Power Platform/DLP/Queries/Analytics/Policy violations over time.kql
new file mode 100644
index 00000000..63087b70
--- /dev/null
+++ b/Azure Services/Power Platform/DLP/Queries/Analytics/Policy violations over time.kql	
@@ -0,0 +1,13 @@
+// Author: russrimm
+// Display name: DLP - Policy Violations Over Time
+// Description: Daily DLP policy violation counts across Power Platform
+// Categories: Power Platform
+// Resource types: Power Platform DLP
+// Topic: Security
+// Prerequisites: Power Platform admin diagnostic settings connected to Log Analytics workspace
+
+PowerPlatformDlpActivity
+| where TimeGenerated > ago(30d)
+| where EventType has "Violation"
+| summarize Violations=count() by PolicyName=tostring(AdditionalInfo), Day=bin(TimeGenerated, 1d)
+| order by Day asc
diff --git a/Azure Services/Power Platform/Dataverse/Queries/Analytics/API call patterns.kql b/Azure Services/Power Platform/Dataverse/Queries/Analytics/API call patterns.kql
new file mode 100644
index 00000000..ed527095
--- /dev/null
+++ b/Azure Services/Power Platform/Dataverse/Queries/Analytics/API call patterns.kql	
@@ -0,0 +1,13 @@
+// Author: russrimm
+// Display name: Dataverse - API Call Patterns
+// Description: SDK vs Web API usage and most-called entity/operation pairs
+// Categories: Power Platform
+// Resource types: Dataverse
+// Topic: Usage Analytics
+// Prerequisites: Power Platform admin diagnostic settings connected to Log Analytics workspace
+
+DataverseActivity
+| where TimeGenerated > ago(30d)
+| summarize Calls=count() by EntityName, Operation
+| order by Calls desc
+| take 30
diff --git a/Azure Services/Power Platform/Dataverse/Queries/Analytics/Bulk operations.kql b/Azure Services/Power Platform/Dataverse/Queries/Analytics/Bulk operations.kql
new file mode 100644
index 00000000..945510d6
--- /dev/null
+++ b/Azure Services/Power Platform/Dataverse/Queries/Analytics/Bulk operations.kql	
@@ -0,0 +1,13 @@
+// Author: russrimm
+// Display name: Dataverse - Bulk Operations
+// Description: ExecuteMultiple, bulk delete, and import operations
+// Categories: Power Platform
+// Resource types: Dataverse
+// Topic: Performance
+// Prerequisites: Power Platform admin diagnostic settings connected to Log Analytics workspace
+
+DataverseActivity
+| where TimeGenerated > ago(30d)
+| where Operation has_any ("ExecuteMultiple", "BulkDelete", "Import", "Export")
+| summarize Count=count(), AvgDurationMs=avg(todouble(DurationMs)) by Operation, Day=bin(TimeGenerated, 1d)
+| order by Day asc
diff --git a/Azure Services/Power Platform/Dataverse/Queries/Analytics/CRUD operation summary.kql b/Azure Services/Power Platform/Dataverse/Queries/Analytics/CRUD operation summary.kql
new file mode 100644
index 00000000..a08c3286
--- /dev/null
+++ b/Azure Services/Power Platform/Dataverse/Queries/Analytics/CRUD operation summary.kql	
@@ -0,0 +1,12 @@
+// Author: russrimm
+// Display name: Dataverse - CRUD Operation Summary
+// Description: Daily create, read, update, delete operation counts across Dataverse
+// Categories: Power Platform
+// Resource types: Dataverse
+// Topic: Usage Analytics
+// Prerequisites: Power Platform admin diagnostic settings connected to Log Analytics workspace
+
+DataverseActivity
+| where TimeGenerated > ago(30d)
+| summarize Count=count() by Operation, Day=bin(TimeGenerated, 1d)
+| order by Day asc
diff --git a/Azure Services/Power Platform/Dataverse/Queries/Analytics/Plugin and workflow failures.kql b/Azure Services/Power Platform/Dataverse/Queries/Analytics/Plugin and workflow failures.kql
new file mode 100644
index 00000000..1f5a2cfb
--- /dev/null
+++ b/Azure Services/Power Platform/Dataverse/Queries/Analytics/Plugin and workflow failures.kql	
@@ -0,0 +1,14 @@
+// Author: russrimm
+// Display name: Dataverse - Plugin and Workflow Failures
+// Description: Failed plugin executions and workflow errors in Dataverse
+// Categories: Power Platform
+// Resource types: Dataverse
+// Topic: Troubleshooting
+// Prerequisites: Power Platform admin diagnostic settings connected to Log Analytics workspace
+
+DataverseActivity
+| where TimeGenerated > ago(7d)
+| where Operation has_any ("Plugin", "Workflow") and (ResultStatus == "Failure" or ResultStatus == "Failed")
+| project TimeGenerated, Operation, EntityName, UserId, ErrorMessage=tostring(AdditionalInfo)
+| order by TimeGenerated desc
+| take 100
diff --git a/Azure Services/Power Platform/Dataverse/Queries/Analytics/Top users by operation volume.kql b/Azure Services/Power Platform/Dataverse/Queries/Analytics/Top users by operation volume.kql
new file mode 100644
index 00000000..c4eeca60
--- /dev/null
+++ b/Azure Services/Power Platform/Dataverse/Queries/Analytics/Top users by operation volume.kql	
@@ -0,0 +1,13 @@
+// Author: russrimm
+// Display name: Dataverse - Top Users by Operation Volume
+// Description: Most active Dataverse users by total operations
+// Categories: Power Platform
+// Resource types: Dataverse
+// Topic: Usage Analytics
+// Prerequisites: Power Platform admin diagnostic settings connected to Log Analytics workspace
+
+DataverseActivity
+| where TimeGenerated > ago(30d)
+| summarize Operations=count(), DistinctTables=dcount(EntityName) by UserId
+| order by Operations desc
+| take 20
diff --git a/Azure Services/Power Platform/Power Apps/Queries/Analytics/App errors and failures.kql b/Azure Services/Power Platform/Power Apps/Queries/Analytics/App errors and failures.kql
new file mode 100644
index 00000000..ee0a8317
--- /dev/null
+++ b/Azure Services/Power Platform/Power Apps/Queries/Analytics/App errors and failures.kql	
@@ -0,0 +1,14 @@
+// Author: russrimm
+// Display name: Power Apps - App Errors and Failures
+// Description: Failed app operations with error details
+// Categories: Power Platform
+// Resource types: Power Apps
+// Topic: Troubleshooting
+// Prerequisites: Power Platform admin diagnostic settings connected to Log Analytics workspace
+
+PowerAppsActivity
+| where TimeGenerated > ago(7d)
+| where ResultStatus == "Failure" or ResultStatus == "Failed"
+| project TimeGenerated, EventType, AppName, UserId, ResultStatus, ErrorMessage=tostring(AdditionalInfo)
+| order by TimeGenerated desc
+| take 100
diff --git a/Azure Services/Power Platform/Power Apps/Queries/Analytics/App launch volume by day.kql b/Azure Services/Power Platform/Power Apps/Queries/Analytics/App launch volume by day.kql
new file mode 100644
index 00000000..9d3fc207
--- /dev/null
+++ b/Azure Services/Power Platform/Power Apps/Queries/Analytics/App launch volume by day.kql	
@@ -0,0 +1,13 @@
+// Author: russrimm
+// Display name: Power Apps - App Launch Volume by Day
+// Description: Daily count of Power App launches with distinct user counts
+// Categories: Power Platform
+// Resource types: Power Apps
+// Topic: Usage Analytics
+// Prerequisites: Power Platform admin diagnostic settings connected to Log Analytics workspace
+
+PowerAppsActivity
+| where TimeGenerated > ago(30d)
+| where EventType == "AppLaunch"
+| summarize Launches=count(), Users=dcount(UserId) by Day=bin(TimeGenerated, 1d)
+| order by Day asc
diff --git a/Azure Services/Power Platform/Power Apps/Queries/Analytics/App lifecycle operations.kql b/Azure Services/Power Platform/Power Apps/Queries/Analytics/App lifecycle operations.kql
new file mode 100644
index 00000000..436ad30f
--- /dev/null
+++ b/Azure Services/Power Platform/Power Apps/Queries/Analytics/App lifecycle operations.kql	
@@ -0,0 +1,13 @@
+// Author: russrimm
+// Display name: Power Apps - App Lifecycle Operations
+// Description: Create, update, delete, and publish operations across Power Apps
+// Categories: Power Platform
+// Resource types: Power Apps
+// Topic: Governance
+// Prerequisites: Power Platform admin diagnostic settings connected to Log Analytics workspace
+
+PowerAppsActivity
+| where TimeGenerated > ago(30d)
+| where EventType in ("AppCreate", "AppUpdate", "AppDelete", "AppPublish")
+| summarize Count=count() by EventType, bin(TimeGenerated, 1d)
+| order by TimeGenerated asc
diff --git a/Azure Services/Power Platform/Power Apps/Queries/Analytics/Permission changes.kql b/Azure Services/Power Platform/Power Apps/Queries/Analytics/Permission changes.kql
new file mode 100644
index 00000000..0596e0b0
--- /dev/null
+++ b/Azure Services/Power Platform/Power Apps/Queries/Analytics/Permission changes.kql	
@@ -0,0 +1,14 @@
+// Author: russrimm
+// Display name: Power Apps - Permission Changes
+// Description: Sharing and permission modifications on Power Apps
+// Categories: Power Platform
+// Resource types: Power Apps
+// Topic: Governance
+// Prerequisites: Power Platform admin diagnostic settings connected to Log Analytics workspace
+
+PowerAppsActivity
+| where TimeGenerated > ago(30d)
+| where EventType has_any ("Permission", "Share", "Unshare", "RoleAssignment")
+| project TimeGenerated, EventType, AppName, UserId, TargetUserId=tostring(AdditionalInfo)
+| order by TimeGenerated desc
+| take 100
diff --git a/Azure Services/Power Platform/Power Apps/Queries/Analytics/Top 20 most used apps.kql b/Azure Services/Power Platform/Power Apps/Queries/Analytics/Top 20 most used apps.kql
new file mode 100644
index 00000000..5b9e6a73
--- /dev/null
+++ b/Azure Services/Power Platform/Power Apps/Queries/Analytics/Top 20 most used apps.kql	
@@ -0,0 +1,14 @@
+// Author: russrimm
+// Display name: Power Apps - Top 20 Most Used Apps
+// Description: Most frequently launched canvas and model-driven apps
+// Categories: Power Platform
+// Resource types: Power Apps
+// Topic: Usage Analytics
+// Prerequisites: Power Platform admin diagnostic settings connected to Log Analytics workspace
+
+PowerAppsActivity
+| where TimeGenerated > ago(30d)
+| where EventType == "AppLaunch"
+| summarize Launches=count(), UniqueUsers=dcount(UserId) by AppName, AppId
+| order by Launches desc
+| take 20
diff --git a/Azure Services/Power Platform/Power Automate/Queries/Analytics/Failures with error details.kql b/Azure Services/Power Platform/Power Automate/Queries/Analytics/Failures with error details.kql
new file mode 100644
index 00000000..ad34198d
--- /dev/null
+++ b/Azure Services/Power Platform/Power Automate/Queries/Analytics/Failures with error details.kql	
@@ -0,0 +1,14 @@
+// Author: russrimm
+// Display name: Cloud Flow Activity - Failures with Error Details
+// Description: Recent failed flow runs with error codes and messages
+// Categories: Power Platform
+// Resource types: Power Automate
+// Topic: Troubleshooting
+// Prerequisites: Power Platform admin diagnostic settings connected to Log Analytics workspace
+
+CloudFlowActivity
+| where TimeGenerated > ago(7d)
+| where ResultStatus == "Failed" or ResultStatus == "Failure"
+| project TimeGenerated, FlowId, FlowDisplayName, ResultStatus, ErrorCode=tostring(AdditionalInfo), UserId
+| order by TimeGenerated desc
+| take 100
diff --git a/Azure Services/Power Platform/Power Automate/Queries/Analytics/Run duration analysis.kql b/Azure Services/Power Platform/Power Automate/Queries/Analytics/Run duration analysis.kql
new file mode 100644
index 00000000..da4f18de
--- /dev/null
+++ b/Azure Services/Power Platform/Power Automate/Queries/Analytics/Run duration analysis.kql	
@@ -0,0 +1,18 @@
+// Author: russrimm
+// Display name: Cloud Flow Activity - Run Duration Analysis
+// Description: Average and P95 flow run durations to identify slow flows
+// Categories: Power Platform
+// Resource types: Power Automate
+// Topic: Performance
+// Prerequisites: Power Platform admin diagnostic settings connected to Log Analytics workspace
+
+CloudFlowActivity
+| where TimeGenerated > ago(30d)
+| where isnotempty(DurationMs)
+| summarize
+    AvgDurationMs=round(avg(todouble(DurationMs)), 0),
+    P95DurationMs=round(percentile(todouble(DurationMs), 95), 0),
+    RunCount=count()
+    by FlowDisplayName, FlowId
+| order by P95DurationMs desc
+| take 20
diff --git a/Azure Services/Power Platform/Power Automate/Queries/Analytics/Run status summary.kql b/Azure Services/Power Platform/Power Automate/Queries/Analytics/Run status summary.kql
new file mode 100644
index 00000000..11465f26
--- /dev/null
+++ b/Azure Services/Power Platform/Power Automate/Queries/Analytics/Run status summary.kql	
@@ -0,0 +1,12 @@
+// Author: russrimm
+// Display name: Cloud Flow Activity - Run Status Summary
+// Description: Daily flow run counts by status (Succeeded, Failed, Cancelled, Running)
+// Categories: Power Platform
+// Resource types: Power Automate
+// Topic: Usage Analytics
+// Prerequisites: Power Platform admin diagnostic settings connected to Log Analytics workspace
+
+CloudFlowActivity
+| where TimeGenerated > ago(30d)
+| summarize RunCount=count() by Status=ResultStatus, Day=bin(TimeGenerated, 1d)
+| order by Day asc
diff --git a/Azure Services/Power Platform/Power Automate/Queries/Analytics/Runs by environment.kql b/Azure Services/Power Platform/Power Automate/Queries/Analytics/Runs by environment.kql
new file mode 100644
index 00000000..cebb6b5f
--- /dev/null
+++ b/Azure Services/Power Platform/Power Automate/Queries/Analytics/Runs by environment.kql	
@@ -0,0 +1,12 @@
+// Author: russrimm
+// Display name: Cloud Flow Activity - Runs by Environment
+// Description: Flow run distribution across Power Platform environments
+// Categories: Power Platform
+// Resource types: Power Automate
+// Topic: Governance
+// Prerequisites: Power Platform admin diagnostic settings connected to Log Analytics workspace
+
+CloudFlowActivity
+| where TimeGenerated > ago(30d)
+| summarize Runs=count(), UniqueFlows=dcount(FlowId), UniqueUsers=dcount(UserId) by EnvironmentId
+| order by Runs desc
diff --git a/Azure Services/Power Platform/Power Automate/Queries/Analytics/Top 20 most active flows.kql b/Azure Services/Power Platform/Power Automate/Queries/Analytics/Top 20 most active flows.kql
new file mode 100644
index 00000000..64d9136b
--- /dev/null
+++ b/Azure Services/Power Platform/Power Automate/Queries/Analytics/Top 20 most active flows.kql	
@@ -0,0 +1,14 @@
+// Author: russrimm
+// Display name: Cloud Flow Activity - Top 20 Most Active Flows
+// Description: Highest-volume flows by run count
+// Categories: Power Platform
+// Resource types: Power Automate
+// Topic: Usage Analytics
+// Prerequisites: Power Platform admin diagnostic settings connected to Log Analytics workspace
+
+CloudFlowActivity
+| where TimeGenerated > ago(30d)
+| summarize Runs=count(), FailedRuns=countif(ResultStatus == "Failed"), UniqueUsers=dcount(UserId) by FlowDisplayName, FlowId
+| extend FailRate=round(todouble(FailedRuns)/todouble(Runs)*100, 1)
+| order by Runs desc
+| take 20
diff --git a/Azure Services/Power Platform/Power Pages/Queries/Analytics/Authentication events.kql b/Azure Services/Power Platform/Power Pages/Queries/Analytics/Authentication events.kql
new file mode 100644
index 00000000..f6f0bfea
--- /dev/null
+++ b/Azure Services/Power Platform/Power Pages/Queries/Analytics/Authentication events.kql	
@@ -0,0 +1,13 @@
+// Author: russrimm
+// Display name: Power Pages - Authentication Events
+// Description: Login, logout, and authentication failure events for Power Pages sites
+// Categories: Power Platform
+// Resource types: Power Pages
+// Topic: Security
+// Prerequisites: Power Platform admin diagnostic settings connected to Log Analytics workspace
+
+PowerPagesActivity
+| where TimeGenerated > ago(30d)
+| where EventType has_any ("Login", "Logout", "AuthFail", "Authentication")
+| summarize Count=count() by EventType, Day=bin(TimeGenerated, 1d)
+| order by Day asc
diff --git a/Azure Services/Power Platform/Power Pages/Queries/Analytics/Form submissions.kql b/Azure Services/Power Platform/Power Pages/Queries/Analytics/Form submissions.kql
new file mode 100644
index 00000000..14bab45f
--- /dev/null
+++ b/Azure Services/Power Platform/Power Pages/Queries/Analytics/Form submissions.kql	
@@ -0,0 +1,13 @@
+// Author: russrimm
+// Display name: Power Pages - Form Submissions
+// Description: Form submission activity across Power Pages sites
+// Categories: Power Platform
+// Resource types: Power Pages
+// Topic: Usage Analytics
+// Prerequisites: Power Platform admin diagnostic settings connected to Log Analytics workspace
+
+PowerPagesActivity
+| where TimeGenerated > ago(30d)
+| where EventType has_any ("FormSubmit", "EntityForm", "WebForm")
+| summarize Submissions=count() by EventType, Day=bin(TimeGenerated, 1d)
+| order by Day asc
diff --git a/Azure Services/Power Platform/Power Pages/Queries/Analytics/Page errors 4xx 5xx.kql b/Azure Services/Power Platform/Power Pages/Queries/Analytics/Page errors 4xx 5xx.kql
new file mode 100644
index 00000000..4add01f5
--- /dev/null
+++ b/Azure Services/Power Platform/Power Pages/Queries/Analytics/Page errors 4xx 5xx.kql	
@@ -0,0 +1,14 @@
+// Author: russrimm
+// Display name: Power Pages - Page Errors (4xx/5xx)
+// Description: HTTP errors and server-side failures on Power Pages sites
+// Categories: Power Platform
+// Resource types: Power Pages
+// Topic: Troubleshooting
+// Prerequisites: Power Platform admin diagnostic settings connected to Log Analytics workspace
+
+PowerPagesActivity
+| where TimeGenerated > ago(7d)
+| where ResultStatus startswith "4" or ResultStatus startswith "5" or ResultStatus == "Failure"
+| project TimeGenerated, EventType, Url=tostring(AdditionalInfo), ResultStatus, UserId
+| order by TimeGenerated desc
+| take 100
diff --git a/Azure Services/Power Platform/Power Pages/Queries/Analytics/Site traffic by day.kql b/Azure Services/Power Platform/Power Pages/Queries/Analytics/Site traffic by day.kql
new file mode 100644
index 00000000..2c014aa6
--- /dev/null
+++ b/Azure Services/Power Platform/Power Pages/Queries/Analytics/Site traffic by day.kql	
@@ -0,0 +1,13 @@
+// Author: russrimm
+// Display name: Power Pages - Site Traffic by Day
+// Description: Daily page views and unique visitors across Power Pages sites
+// Categories: Power Platform
+// Resource types: Power Pages
+// Topic: Usage Analytics
+// Prerequisites: Power Platform admin diagnostic settings connected to Log Analytics workspace
+
+PowerPagesActivity
+| where TimeGenerated > ago(30d)
+| where EventType == "PageView"
+| summarize PageViews=count(), UniqueVisitors=dcount(UserId) by Day=bin(TimeGenerated, 1d)
+| order by Day asc