Forum Discussion

Chris_321's avatar
Chris_321
Copper Contributor
Mar 31, 2022

Unusual user agent found in table AADNonInteractiveUserSignInLogs

Hello,   Investigating the registers of the table "AADNonInteractiveUserSignInLogs", I have found a user-agent "Rich Client 4.40.0.0", which investigating via web I have not found information about...
siem
GaryBushey's avatar
GaryBushey
Bronze Contributor
Mar 31, 2022
I have not seen this in my environment but it sounds like a phone app or something similar
  • Chris_321's avatar
    Chris_321
    Copper Contributor
    Mar 31, 2022
    But the connection is made via Microsoft authenticator to validate the authentication by MFA, i.e. the user agent Rich Client 4.40.0.0.0 is the Microsoft authenticator?
    • GaryBushey's avatar
      GaryBushey
      Bronze Contributor
      Mar 31, 2022
      Could it be the Azure app someone is running on their phone? Or possibly a different app that uses the MS MFA?

Resources