Matching SharePoint machine ID to Intune

%3CLINGO-SUB%20id%3D%22lingo-sub-1415670%22%20slang%3D%22en-US%22%3EMatching%20SharePoint%20machine%20ID%20to%20Intune%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1415670%22%20slang%3D%22en-US%22%3E%3CP%3EI%20am%20looking%20at%20some%20sharepoint%20logs%20for%20an%20alert%20but%20I%20cannot%20tell%20if%20the%20machine%20being%20used%20is%20one%20that%20is%20managed%20by%20our%20Intune%20or%20not.%20The%20machine%20ID%20from%20the%20sharepoint%20logs%20does%20not%20correspond%20to%20any%20format%20in%20Intune.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIs%20it%20possible%20to%20match%20these%20in%20some%20way%20or%20figure%20out%20if%20the%20machine%20is%20managed%20from%20SharePoint%20logs%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1415920%22%20slang%3D%22en-US%22%3ERe%3A%20Matching%20SharePoint%20machine%20ID%20to%20Intune%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1415920%22%20slang%3D%22en-US%22%3EI%20don't%20have%20an%20example%20in%20front%20of%20me.%20But%20I%20think%20these%20ID's%20should%20be%20Azure%20AD%20devices%20IDs.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1415950%22%20slang%3D%22en-US%22%3ERe%3A%20Matching%20SharePoint%20machine%20ID%20to%20Intune%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1415950%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F186539%22%20target%3D%22_blank%22%3E%40Thijs%20Lecomte%3C%2FA%3E%26nbsp%3BI%20was%20hoping%20that%20but%20it%20doesn't%20appear%20to%20be%20the%20case%20from%20what%20I%20can%20tell.%20I%20have%20a%20machine%20ID%20like%20this%26nbsp%3B%3CSPAN%3E547f88ef-15d4-407d-88bd-75d0edf8c7bc%20but%20my%20Azure%20AD%20%2F%20Intune%20device%20has%20an%20ID%20in%20a%20similar%20format%20that%20is%20completely%20different.%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3ENone%20of%20my%20devices%20appear%20to%20match%20this%20string.%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1415963%22%20slang%3D%22en-US%22%3ERe%3A%20Matching%20SharePoint%20machine%20ID%20to%20Intune%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1415963%22%20slang%3D%22en-US%22%3ECould%20you%20share%20the%20analytics%20query%20which%20throws%20the%20alert%3F%3CBR%20%2F%3EThat%20way%2C%20I%20can%20check%20where%20the%20ID%20is%20coming%20from%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1415997%22%20slang%3D%22en-US%22%3ERe%3A%20Matching%20SharePoint%20machine%20ID%20to%20Intune%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1415997%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F186539%22%20target%3D%22_blank%22%3E%40Thijs%20Lecomte%3C%2FA%3E%26nbsp%3BHere%20is%20the%20query%3A%3C%2FP%3E%3CPRE%20class%3D%22lia-code-sample%20language-applescript%22%3E%3CCODE%3EOfficeActivity%0A%7C%20where%20TimeGenerated%20%26gt%3B%20ago(15m)%0A%7C%20where%20OfficeWorkload%20%3D%3D%20%22SharePoint%22%0A%7C%20where%20Operation%20in%20(%22FileDeleted%22%2C%20%22FileSyncDownloadedFull%22%2C%20%22FolderDeleted%22%2C%20%22FileDownloaded%22)%0A%7C%20summarize%20count()%20by%20bin(TimeGenerated%2C%2015m)%2C%20Operation%2C%20UserId%2C%20Site_Url%2C%20ClientIP%0A%7C%20where%20count_%20%26gt%3B%20100%0A%7C%20extend%20AccountCustomEntity%20%3D%20UserId%0A%7C%20extend%20IPCustomEntity%20%3D%20ClientIP%0A%7C%20extend%20URLCustomEntity%20%3D%20Site_Url%3C%2FCODE%3E%3C%2FPRE%3E%3CP%3EThe%20info%20generated%20here%20is%20the%20same%20as%20what%20I%20can%20see%20in%20the%20Audit%20Logs%20in%20Security%20and%20Compliance%20center.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EBasically%20we're%20alerting%20for%20excessive%20downloads%20or%20deletions%20that%20might%20indicate%20malicious%20activity.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1416028%22%20slang%3D%22en-US%22%3ERe%3A%20Matching%20SharePoint%20machine%20ID%20to%20Intune%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1416028%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F449184%22%20target%3D%22_blank%22%3E%40endakelly%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EYou%20have%20made%20a%20really%20interesting%20point.%20I%20just%20searched%20for%20this%20information%20in%20my%20own%20environment%2C%20but%20couldn't%20find%20anything.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F324945%22%20target%3D%22_blank%22%3E%40rodtrent%3C%2FA%3E%26nbsp%3B%20any%20chance%20you%20can%20chime%20in%20and%20give%20us%20some%20more%20insights%20into%20how%20we%20can%20correlate%20machineID%20from%20the%20Sharepoint%20logs%20to%20an%20AAD%20device%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1416046%22%20slang%3D%22en-US%22%3ERe%3A%20Matching%20SharePoint%20machine%20ID%20to%20Intune%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1416046%22%20slang%3D%22en-US%22%3EAccording%20to%20my%20research%20this%20is%20the%20Onedrive%20Machine%20ID%2C%20but%20I%20don't%20think%20there%20is%20a%20way%20to%20correlate%20it%20to%20AAD%2FIntune%20%3CA%20href%3D%22https%3A%2F%2Fhansbrender.com%2F2020%2F01%2F15%2Fthe-onedrive-device-id%2F%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fhansbrender.com%2F2020%2F01%2F15%2Fthe-onedrive-device-id%2F%3C%2FA%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1423251%22%20slang%3D%22en-US%22%3ERe%3A%20Matching%20SharePoint%20machine%20ID%20to%20Intune%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1423251%22%20slang%3D%22en-US%22%3E%3CP%3EThe%20plot%20thickens%20on%20this%20one.%20So%20I%20was%20investigating%20another%20incident%20this%20morning%20and%20copied%20the%20machine%20id%20and%20checked%20it%20against%20Intune.%20Looking%20at%20the%20hardware%20properties%20for%20the%20users%20machines%20I%20found%20an%20attribute%20called%20UDID%20which%20is%20a%20perfect%20match%20%3AD%3C%2Fimg%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EProblem%20is%2C%20this%20attribute%20is%20not%20exposed%20in%20the%20graph%20api%20from%20what%20I%20can%20see%20so%20far%20using%20the%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fgraph.microsoft.com%2Fv1.0%2Fusers%2FUPN%2FmanagedDevices%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fgraph.microsoft.com%2Fv1.0%2Fusers%2FUPN%2FmanagedDevices%3C%2FA%3E%26nbsp%3Bquery%20(same%20with%20beta).%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThis%20device%20was%20a%20Mac%20and%20this%20attribute%20looks%20to%20be%20unique%20to%20them.%20No%20attributes%20for%20Windows%20have%20matching%20Machine%20IDs.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EMachine%20ID%20is%20only%20an%20attribute%20on%20the%20FileSyncDownloadedFull%20operation%20which%20isn't%20a%20massive%20deal%20but%20it%20would%20be%20nice%20to%20be%20able%20to%20correlate%20Machine%20IDs%20with%20FileDelete%20and%20FolderDelete%20operations%20too%20so%20you%20can%20be%20sure%20if%20a%20mass%20delete%20happened%20from%20a%20managed%20device%20or%20not.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIs%20it%20possible%20to%20have%20this%20UDID%20attribute%20exposed%20to%20the%20graph%20api%20or%20is%20there%20another%20query%20I%20should%20be%20using%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1440125%22%20slang%3D%22en-US%22%3ERe%3A%20Matching%20SharePoint%20machine%20ID%20to%20Intune%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1440125%22%20slang%3D%22en-US%22%3EI%20have%20been%20looking%20into%20this%20as%20well.%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fgithub.com%2FMicrosoftDocs%2Fazure-docs%2Fissues%2F55589%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fgithub.com%2FMicrosoftDocs%2Fazure-docs%2Fissues%2F55589%3C%2FA%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3CBR%20%2F%3EI%20haven't%20found%20anything%20with%20it%2C%20I%20have%20opened%20up%20a%20support%20case%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1440172%22%20slang%3D%22en-US%22%3ERe%3A%20Matching%20SharePoint%20machine%20ID%20to%20Intune%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1440172%22%20slang%3D%22en-US%22%3EI%20submitted%20an%20idea%20to%20the%20graph%20uservoice%20as%20well%20%3CA%20href%3D%22https%3A%2F%2Fmicrosoftgraph.uservoice.com%2Fforums%2F920506-microsoft-graph-feature-requests%2Fsuggestions%2F40585561-expose-macos-udid-via-api%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fmicrosoftgraph.uservoice.com%2Fforums%2F920506-microsoft-graph-feature-requests%2Fsuggestions%2F40585561-expose-macos-udid-via-api%3C%2FA%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1528704%22%20slang%3D%22en-US%22%3ERe%3A%20Matching%20SharePoint%20machine%20ID%20to%20Intune%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1528704%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F186539%22%20target%3D%22_blank%22%3E%40Thijs%20Lecomte%3C%2FA%3E%26nbsp%3Bdid%20you%20ever%20get%20a%20reply%20to%20the%20support%20ticket%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1528932%22%20slang%3D%22en-US%22%3ERe%3A%20Matching%20SharePoint%20machine%20ID%20to%20Intune%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1528932%22%20slang%3D%22en-US%22%3EYeah%2C%20there%20is%20currently%20no%20way...%3CBR%20%2F%3EI%20have%20launched%20a%20UserVoice%20and%20I%20am%20also%20in%20contact%20with%20a%20Sharepoint%20PM.%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Foffice365.uservoice.com%2Fforums%2F289138-office-365-security-compliance%2Fsuggestions%2F40902784-machine-id-correlation%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Foffice365.uservoice.com%2Fforums%2F289138-office-365-security-compliance%2Fsuggestions%2F40902784-machine-id-correlation%3C%2FA%3E%3C%2FLINGO-BODY%3E
Contributor

I am looking at some sharepoint logs for an alert but I cannot tell if the machine being used is one that is managed by our Intune or not. The machine ID from the sharepoint logs does not correspond to any format in Intune.

 

Is it possible to match these in some way or figure out if the machine is managed from SharePoint logs?

11 Replies
I don't have an example in front of me. But I think these ID's should be Azure AD devices IDs.

@Thijs Lecomte I was hoping that but it doesn't appear to be the case from what I can tell. I have a machine ID like this 547f88ef-15d4-407d-88bd-75d0edf8c7bc but my Azure AD / Intune device has an ID in a similar format that is completely different.

 

None of my devices appear to match this string.

Could you share the analytics query which throws the alert?
That way, I can check where the ID is coming from

@Thijs Lecomte Here is the query:

OfficeActivity
| where TimeGenerated > ago(15m)
| where OfficeWorkload == "SharePoint"
| where Operation in ("FileDeleted", "FileSyncDownloadedFull", "FolderDeleted", "FileDownloaded")
| summarize count() by bin(TimeGenerated, 15m), Operation, UserId, Site_Url, ClientIP
| where count_ > 100
| extend AccountCustomEntity = UserId
| extend IPCustomEntity = ClientIP
| extend URLCustomEntity = Site_Url

The info generated here is the same as what I can see in the Audit Logs in Security and Compliance center. 

 

Basically we're alerting for excessive downloads or deletions that might indicate malicious activity.

@endakelly 

 

You have made a really interesting point. I just searched for this information in my own environment, but couldn't find anything.

 

@rodtrent  any chance you can chime in and give us some more insights into how we can correlate machineID from the Sharepoint logs to an AAD device?

According to my research this is the Onedrive Machine ID, but I don't think there is a way to correlate it to AAD/Intune https://hansbrender.com/2020/01/15/the-onedrive-device-id/

The plot thickens on this one. So I was investigating another incident this morning and copied the machine id and checked it against Intune. Looking at the hardware properties for the users machines I found an attribute called UDID which is a perfect match :D

 

Problem is, this attribute is not exposed in the graph api from what I can see so far using the https://graph.microsoft.com/v1.0/users/UPN/managedDevices query (same with beta).

 

This device was a Mac and this attribute looks to be unique to them. No attributes for Windows have matching Machine IDs.

 

Machine ID is only an attribute on the FileSyncDownloadedFull operation which isn't a massive deal but it would be nice to be able to correlate Machine IDs with FileDelete and FolderDelete operations too so you can be sure if a mass delete happened from a managed device or not.

 

Is it possible to have this UDID attribute exposed to the graph api or is there another query I should be using?

I have been looking into this as well.
https://github.com/MicrosoftDocs/azure-docs/issues/55589


I haven't found anything with it, I have opened up a support case

@Thijs Lecomte did you ever get a reply to the support ticket?

Yeah, there is currently no way...
I have launched a UserVoice and I am also in contact with a Sharepoint PM.
https://office365.uservoice.com/forums/289138-office-365-security-compliance/suggestions/40902784-ma...