Unified Audit Logs - UserAgents

Copper Contributor


I'm doing some work  with SharePoint online, specifically, and am trying to get a handle on the "UserAgent" field. I keep seeing agents which I would like to try and clarify what they are doing or why they appear, hopefully someone can help?


OneDriveMpc-Transform_Thumbnail/1.0 - Assume this is when the document is previewed?

OneDriveMpc-Transform_Zip/1.0 - I see this appear multiple times against the same document with the same time stamp.. any ideas?

ODMTAAnalysis/1.0 Interactive - ?

ODMTADemand-Transform_VideoManifest/1.0 - ?

ODMTADemand-Transform_VideoTranscode/1.0 - ?

ODMTADocCache/1.0 - ?


Any help would be great,




5 Replies

As the user agent is a free text string and can change at any time (or be spoofed), I wouldnt rely on this. I'm not aware of any list that Microsoft published on the above anyway, so all we can offer is some educated guess.

@Holleboom   Having Same issues here, we really would like a List of the User Agent strings  that Microsoft has assigned its Server. (Good Ole Loki)  I doubt MS is going the Spoof their own UAS in their SharePoint/O365 Environment.  FWIW I think the OneDrive ZIP is when user Downloads several docs simultaneously and OneDrive Zips them up. (They are very cagey on the phone Q's like these get bumped up to a Level Two Tech, who may or may not answer your Question correctly (Assuming they call you back) . 

The user agent string Onedrivempc is the OneDrive for Business web viewer

you want to more about security related audit detail in audit check out.