SharePoint/OneDrive activity app@sharepoint

%3CLINGO-SUB%20id%3D%22lingo-sub-1473817%22%20slang%3D%22en-US%22%3ESharePoint%2FOneDrive%20activity%20app%40sharepoint%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1473817%22%20slang%3D%22en-US%22%3E%3CP%3EI've%20just%20noticed%20that%20in%20the%20last%2024%20hours%20we%20are%20seeing%20a%20lot%20of%20users%20office%20activity%20in%20SharePoint%20and%20OneDrive%20be%20replaced%20by%20the%20UserId%20%3CA%20href%3D%22mailto%3Aapp%40sharepoint%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Eapp%40sharepoint%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThere%20is%20a%20common%20theme%20here%20in%20that%20the%20users%20in%20question%20all%20have%20user%20agents%20of%26nbsp%3B%20Zget%2F6.0r.208.232253_84%20repos%2Fsm%2Fbranches%2F6.0r%20%24Id%3A%20.label%20232254%202020-05-27%2016%3A36%3A08Z%20build%20%24%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHas%20anyone%20come%20across%20this%20before%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1475005%22%20slang%3D%22en-US%22%3ERe%3A%20SharePoint%2FOneDrive%20activity%20app%40sharepoint%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1475005%22%20slang%3D%22en-US%22%3EI%20am%20have%20seeing%20this%20too%20this%20week.%3CBR%20%2F%3Eit%20seems%20to%20be%20some%20kind%20of%20service%20account%20that%20Microsoft%20hasn't%20fixed%20-%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fmicrosoft-security-and%2Faudit-log-user-shown-as-app-sharepoint%2Fm-p%2F171568%2Fhighlight%2Ffalse%23M1089%22%20target%3D%22_blank%22%3Ehttps%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fmicrosoft-security-and%2Faudit-log-user-shown-as-app-sharepoint%2Fm-p%2F171568%2Fhighlight%2Ffalse%23M1089%3C%2FA%3E%3C%2FLINGO-BODY%3E
Contributor

I've just noticed that in the last 24 hours we are seeing a lot of users office activity in SharePoint and OneDrive be replaced by the UserId app@sharepoint

 

There is a common theme here in that the users in question all have user agents of  Zget/6.0r.208.232253_84 repos/sm/branches/6.0r $Id: .label 232254 2020-05-27 16:36:08Z build $

 

Has anyone come across this before?

1 Reply
I am have seeing this too this week.
it seems to be some kind of service account that Microsoft hasn't fixed - https://techcommunity.microsoft.com/t5/microsoft-security-and/audit-log-user-shown-as-app-sharepoint...