Forum Discussion
Local IPs ( 10.60.0.0/24 ) in ClientIP field in OfficeActivity logs?
Started seeing this more often recently and it started to cause some uptick in alerts across multiple customers (we are an MSP). It seems to me like a backend workflow is failing to write true source...
This is a bug with certain UserAgents, first it was happening with unmanaged devices, then also with managed devices. Information about the real IP address is being lost, I have opened a support case.
ep3p : can you update us on the support case?
we are also seeing this behaviour (also MSSP) at multiple customer sentinel instances.
but it also seems to happen at the microsoftgraphactivitylogs, see: