
Explanation:

In Microsoft Sentinel workbooks, parameters can be referenced directly in KQL. For multi-select parameters that include an All option, the recommended pattern is to check the parameter's label for "All" and otherwise filter by the selected values. Hence:
where ( " {Operations:label} " == " All " or Operation in ({Operations})) This lets the visual treat All as a single choice while still supporting one or many explicit operations.
You also need a Users parameter, so you'd typically include:
| where UserId in ({Users})
Because the data source is OfficeActivity , to scope to SharePoint and OneDrive activity:
| where OfficeWorkload in ( ' OneDrive ' , ' SharePoint ' )
Finally, to exclude empty site URLs , filter out blanks:
| where Site_Url != ' '
Putting it together (for context):
OfficeActivity
| where ( " {Operations:label} " == " All " or Operation in ({Operations}))
| where OfficeWorkload in ( ' OneDrive ' , ' SharePoint ' )
| where UserId in ({Users})
| where Site_Url != ' '
| project Site_Url, UserId, Operation, TimeGenerated