Mismatch between Cloud Discovery UI user count and /cas/api/v1/discovery/discovered_apps/ API response

We are integrating Microsoft Defender for Cloud Apps Cloud Discovery data into our backend and noticed a consistent discrepancy between the portal UI and the REST API results.

Specifically:

• The Cloud Discovery UI https://security.microsoft.com/cloudapps/discovery?tab=services shows a higher user count for certain discovered apps.
• The Defender for Cloud Apps REST API endpoint GET /cas/api/v1/discovery/discovered_apps/ returns a lower usersCount for the same apps.

This comparison is done:

• in the same tenant
• with Cloud Discovery enabled and actively ingesting data
• using the default/global Cloud Discovery view (no custom stream filters)
• by directly calling the /cas/api/v1/discovery/discovered_apps/ endpoint

Questions we need clarification on

1. Is the usersCount field in /cas/api/v1/discovery/discovered_apps/ expected to exactly match the Cloud Discovery UI?
2. If not:
   • What does usersCount in this endpoint represent precisely?
   • Which API endpoint should be used to retrieve the same per-app user counts shown in the portal UI?
3. Is this a known limitation or known issue with the /cas/api/v1/discovery/discovered_apps/ endpoint?