Microsoft Secure Tech Accelerator
Apr 03 2024, 07:00 AM - 11:00 AM (PDT)
Microsoft Tech Community

Unusual user agent found in table AADNonInteractiveUserSignInLogs

Copper Contributor

Hello,

 

Investigating the registers of the table "AADNonInteractiveUserSignInLogs", I have found a user-agent "Rich Client 4.40.0.0", which investigating via web I have not found information about it, neither I have knowledge of what this user-agent is about.

 

Has anyone seen this in a case related to Azure log-ins?

 

Regards.

3 Replies
I have not seen this in my environment but it sounds like a phone app or something similar
But the connection is made via Microsoft authenticator to validate the authentication by MFA, i.e. the user agent Rich Client 4.40.0.0.0 is the Microsoft authenticator?
Could it be the Azure app someone is running on their phone? Or possibly a different app that uses the MS MFA?