Forum Discussion
Unified Audit Logs - UserAgents field
Hi, I'm investigating access logs pulled from Unified Audit Logs for OneDrive online, specifically. The UserAgent field value is populeted with multiple values all starting with 'onenotemodernsyn...
Looks like activities corresponding to the background sync process when you have a OneNote opened in the desktop app and make changes to it. Check the ClientAppId/ClientAppName value to confirm.
- Appreciate the response.
The ClientAppName is just random numbers - not very insightful. Is there any way to desipher the random numbers?
"ClientAppName":"2d4d3d8e-2be3-4bef-9f87-XXXXXXXX"- If you paste the value in your favorite search engine, it will come up with the following: https://learn.microsoft.com/en-us/troubleshoot/azure/active-directory/verify-first-party-apps-sign-in#application-ids-of-commonly-used-microsoft-applications
To me, it looks like the regular OneNote sync processes, as mentioned above, so you can safely ignore such entries.
