Forum Discussion
Local IPs ( 10.60.0.0/24 ) in ClientIP field in OfficeActivity logs?
Started seeing this more often recently and it started to cause some uptick in alerts across multiple customers (we are an MSP). It seems to me like a backend workflow is failing to write true source...
We see this same data across all of our clients. It almost appears like Onedrive is establishing a VPN-type connection to a microsoft data center, then syncing your files. It appears to only happen during onedrive activities. I'm very curious to see if this is the case.
That's a good point, we see the same.. FileDownloaded operations are OneDrive, while other operations look like variations of OneDrive user agents or Office, which I imagine is doing the same thing
