User Sign in details wrong in report

%3CLINGO-SUB%20id%3D%22lingo-sub-856846%22%20slang%3D%22en-US%22%3EUser%20Sign%20in%20details%20wrong%20in%20report%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-856846%22%20slang%3D%22en-US%22%3E%3CP%3EI'm%20not%20sure%20how%20the%20device%20info%20is%20determined%20for%20User%20Signs-ins%2C%20but%20I'm%20seeing%20the%20interesting%20combo%20of%20OS%3AWindowsPhone%20and%20Browser%3AAndroid%204.0%20!%26nbsp%3B%20Not%20sure%20which%20I%20want%20to%20believe%2C%20as%20neither%20are%20attractive%20propositions%20now.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-856846%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20AD%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-857308%22%20slang%3D%22en-US%22%3ERe%3A%20User%20Sign%20in%20details%20wrong%20in%20report%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-857308%22%20slang%3D%22en-US%22%3E%3CP%3EThose%20might%20be%20standard%20%22template%22%20values%20used%20by%20different%20clients.%20For%20example%2C%20PowerShell%20is%20a%20common%20%22offender%22%2C%20or%20EWS-based%20clients%20-%20I%20can%20see%20few%20logins%20from%20Windows%208%20and%20IE%207.0%20in%20my%20logs%2C%20which%20I%20haven't%20used%20for%20years%20now.%20Just%20ignore%20them.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1746103%22%20slang%3D%22en-US%22%3ERe%3A%20User%20Sign%20in%20details%20wrong%20in%20report%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1746103%22%20slang%3D%22en-US%22%3E%3CP%3EWe%26nbsp%3Bare%20having%20something%20similar%20with%20one%20of%20our%20end%20users.%26nbsp%3B%20When%20he%20attempts%20to%20login%20to%20outlook%20or%20Office365%20portal%20from%20his%20iphone%20it%20shows%20his%20location%20is%20in%20another%20state%2C%20but%20his%20sitting%20in%20my%20office.%26nbsp%3B%20I've%20rebooted%20and%20checked%20his%20phone%20to%20make%20sure%20there%20is%20no%20malware%20and%20his%20GPS%20telemetry%20in%20maps%20shows%20him%20in%20the%20correct%20location.%26nbsp%3B%20After%2025%20years%20of%20IT%20work%20I%20really%20starting%20to%20hate%20Technology.%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F15390%22%20target%3D%22_blank%22%3E%40Lloyd%20Adams%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1748186%22%20slang%3D%22en-US%22%3ERe%3A%20User%20Sign%20in%20details%20wrong%20in%20report%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1748186%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F275475%22%20target%3D%22_blank%22%3E%40AceBandage%3C%2FA%3EIs%20it%20using%20their%20GPS%20location%2C%20or%20performing%20a%20geo%20location%20lookup%20on%20their%20ip%20address%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E
Regular Contributor

I'm not sure how the device info is determined for User Signs-ins, but I'm seeing the interesting combo of OS:WindowsPhone and Browser:Android 4.0 !  Not sure which I want to believe, as neither are attractive propositions now.

3 Replies

Those might be standard "template" values used by different clients. For example, PowerShell is a common "offender", or EWS-based clients - I can see few logins from Windows 8 and IE 7.0 in my logs, which I haven't used for years now. Just ignore them.

We are having something similar with one of our end users.  When he attempts to login to outlook or Office365 portal from his iphone it shows his location is in another state, but his sitting in my office.  I've rebooted and checked his phone to make sure there is no malware and his GPS telemetry in maps shows him in the correct location.  After 25 years of IT work I really starting to hate Technology.@Lloyd Adams 

@AceBandageIs it using their GPS location, or performing a geo location lookup on their ip address?