May 07 2020
12:41 PM
- last edited on
Jan 14 2022
04:31 PM
by
TechCommunityAP
May 07 2020
12:41 PM
- last edited on
Jan 14 2022
04:31 PM
by
TechCommunityAP
Hello,
When I look at Azure AD Sign-ins Logs, I see many different applications. Some of them are very clear, but not all. For example, what are
dev-rel-auth-prod
AEO Frontend Production
AEO Frontend Production
Office365 Shell WCSS-Client
There are some explanations for the latter but it is not clear. For example what are URLs for these? Is there any explanatory document that presents a list of these kind of details?
Thanks,
May 12 2020 06:26 AM
Office 365 Shell WCSS-Client is the browser code that runs whenever a user navigates to (most) Office365 applications in the browser. The shell, also known as the suite header, is shared code that loads as part of almost all Office365 workloads, including SharePoint, OneDrive, Outlook, Yammer, and many more
The other apps can be apps that are registered in Azure AD. For example developers that are creating Apps in connection with Azure AD. Therefore they need to create an app registration. If you go to Azure Active Directory -> App Registrations you get an overview of all registrations that are connected towards your Azure AD tenant.
May 12 2020 11:47 AM - edited May 12 2020 11:48 AM
@JordyBlommaert Would you or anybody know what the application "vortex [wsfed enabled]" is? It is not a registered application in our tenant. It has popped up for a couple of our users but they do not know what that is or what they did to cause that sign-in activity. All the other sign-in information is as expected (IP address, location, browser, OS)
Here is a sample entry from the Azure Active Directory Sign-In log:
May 12 2020 12:40 PM
@JordyBlommaert Thank you for your reply and explanations for Office365 Shell WCSS-Client. However, I'm definitely disagree with other comment. I have applications in my sign-in logs like:
ACOM Azure Website
AEO Frontend Production
dev-rel-auth-prod
which are not listed in Applications list in the portal. There is also AIRS application which is only listed among applications, but there is no any other explanation. So, I am trying to learn what those applications are and what they are used for.
Thx,
May 12 2020 10:18 PM
@Betty Stolwyk Microsoft reported this as an internal error code and can be ignored. Reference Article https://github.com/MicrosoftDocs/azure-docs/issues/10766
May 12 2020 10:23 PM
May 13 2020 07:56 AM
@JordyBlommaert, I see those logs from my own sign-in logs and I don't have and am not using any specific or home made application.
May 22 2020 11:09 AM
I'm also seeing a lot of failures for "dev-rel-auth-prod" and would like to know what it is. The failures always have Sign-in error code 500581 (Session information is not sufficient for single-sign-on on V2 with prompt=none to verify if MSA account.). Sometimes they're almost immediately followed by a Success.
Jun 26 2020 10:01 AM
I'm seeing unusual failed login attempts to the ACOM Azure Website application as well. Was this question ever answered about what this application is? I also don't see it in the Enterprise Applications listing.
Jan 13 2021 11:46 AM
Any update on this. Just came across a log saying I signed in using this Vortex app.
Jan 13 2021 11:55 AM
These "suspicious" sign-ins to ACOM Azure Website were being generated by our users when they were going to standard websites like https://azure.microsoft.com and browsing general information but with silent logins their with accounts in our tenant. Shared the finding with Premier and they were surprised but said there was nothing to be concerned with security-wise.
Oct 16 2023 08:57 AM