Forum Discussion
Microsoft IPs in audit logs
I'm investigating an incident and noticed that in many instances throughout the audit log, there is a Microsoft IP address associated with the action (in this case the action is "FileAccessed"). I'd ...
Lewis-H thanks for the response. I have the full audit log already, I'm just curious about what the Microsoft IPs within it indicate. I see a combination of personal, company, and Microsoft IPs and I'm wondering whether the Microsoft IPs could indicate that the file was accessed by a person, or whether it is just a backend process that takes place when loading the page or something.
Years later and we still have to deal with way too many audit log entries where the "client" IP is one of Microsoft's. They mustn't be concerned about fixing the auditing to be accurate.