Microsoft Secure Tech Accelerator
Apr 03 2024, 07:00 AM - 11:00 AM (PDT)
Microsoft Tech Community

SharePoint/OneDrive activity app@sharepoint

Brass Contributor

I've just noticed that in the last 24 hours we are seeing a lot of users office activity in SharePoint and OneDrive be replaced by the UserId app@sharepoint

 

There is a common theme here in that the users in question all have user agents of  Zget/6.0r.208.232253_84 repos/sm/branches/6.0r $Id: .label 232254 2020-05-27 16:36:08Z build $

 

Has anyone come across this before?

1 Reply
I am have seeing this too this week.
it seems to be some kind of service account that Microsoft hasn't fixed - https://techcommunity.microsoft.com/t5/microsoft-security-and/audit-log-user-shown-as-app-sharepoint...