Unified Audit Logs - UserAgents

[Holleboom]

Hi,

I'm doing some work  with SharePoint online, specifically, and am trying to get a handle on the "UserAgent" field. I keep seeing agents which I would like to try and clarify what they are doing or why they appear, hopefully someone can help?

OneDriveMpc-Transform_Thumbnail/1.0 - Assume this is when the document is previewed?

OneDriveMpc-Transform_Zip/1.0 - I see this appear multiple times against the same document with the same time stamp.. any ideas?

ODMTAAnalysis/1.0 Interactive - ?

ODMTADemand-Transform_VideoManifest/1.0 - ?

ODMTADemand-Transform_VideoTranscode/1.0 - ?

ODMTADocCache/1.0 - ?

Any help would be great,

Cheers

Damian

[#2]

As the user agent is a free text string and can change at any time (or be spoofed), I wouldnt rely on this. I'm not aware of any list that Microsoft published on the above anyway, so all we can offer is some educated guess.

[#3]

@Holleboom   Having Same issues here, we really would like a List of the User Agent strings  that Microsoft has assigned its Server. (Good Ole Loki)  I doubt MS is going the Spoof their own UAS in their SharePoint/O365 Environment.  FWIW I think the OneDrive ZIP is when user Downloads several docs simultaneously and OneDrive Zips them up. (They are very cagey on the phone Q's like these get bumped up to a Level Two Tech, who may or may not answer your Question correctly (Assuming they call you back) . 

[#4]

The user agent string Onedrivempc is the OneDrive for Business web viewer

[#5]

https://answers.microsoft.com/en-us/msoffice/forum/msoffice_o365admin-mso_security-mso_o365b/about-t...

[#6]

you want to more about security related audit detail in audit check out.

https://blog.admindroid.com/unified-audit-log-a-guide-to-track-office-365-activities/