Unified Audit Logs - UserAgents

%3CLINGO-SUB%20id%3D%22lingo-sub-1758030%22%20slang%3D%22en-US%22%3EUnified%20Audit%20Logs%20-%20UserAgents%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1758030%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3EI'm%20doing%20some%20work%26nbsp%3B%20with%20SharePoint%20online%2C%20specifically%2C%20and%20am%20trying%20to%20get%20a%20handle%20on%20the%20%22UserAgent%22%20field.%20I%20keep%20seeing%20agents%20which%20I%20would%20like%20to%20try%20and%20clarify%20what%20they%20are%20doing%20or%20why%20they%20appear%2C%20hopefully%20someone%20can%20help%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EOneDriveMpc-Transform_Thumbnail%2F1.0%20-%20Assume%20this%20is%20when%20the%20document%20is%20previewed%3F%3C%2FP%3E%3CP%3EOneDriveMpc-Transform_Zip%2F1.0%20-%20I%20see%20this%20appear%20multiple%20times%20against%20the%20same%20document%20with%20the%20same%20time%20stamp..%20any%20ideas%3F%3C%2FP%3E%3CP%3EODMTAAnalysis%2F1.0%20Interactive%20-%20%3F%3C%2FP%3E%3CP%3EODMTADemand-Transform_VideoManifest%2F1.0%20-%20%3F%3C%2FP%3E%3CP%3EODMTADemand-Transform_VideoTranscode%2F1.0%20-%20%3F%3C%2FP%3E%3CP%3EODMTADocCache%2F1.0%20-%20%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAny%20help%20would%20be%20great%2C%3C%2FP%3E%3CP%3ECheers%3C%2FP%3E%3CP%3EDamian%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1758030%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOneDrive%20for%20Business%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESharePoint%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1760294%22%20slang%3D%22en-US%22%3ERe%3A%20Unified%20Audit%20Logs%20-%20UserAgents%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1760294%22%20slang%3D%22en-US%22%3E%3CP%3EAs%20the%20user%20agent%20is%20a%20free%20text%20string%20and%20can%20change%20at%20any%20time%20(or%20be%20spoofed)%2C%20I%20wouldnt%20rely%20on%20this.%20I'm%20not%20aware%20of%20any%20list%20that%20Microsoft%20published%20on%20the%20above%20anyway%2C%20so%20all%20we%20can%20offer%20is%20some%20educated%20guess.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1841617%22%20slang%3D%22en-US%22%3ERe%3A%20Unified%20Audit%20Logs%20-%20UserAgents%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1841617%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F824681%22%20target%3D%22_blank%22%3E%40Holleboom%3C%2FA%3E%26nbsp%3B%20%26nbsp%3BHaving%20Same%20issues%20here%2C%20we%20really%20would%20like%20a%20List%20of%20the%20User%20Agent%20strings%26nbsp%3B%20that%20Microsoft%20has%20assigned%20its%20Server.%20(Good%20Ole%20Loki)%26nbsp%3B%20I%20doubt%20MS%20is%20going%20the%20Spoof%20their%20own%20UAS%20in%20their%20SharePoint%2FO365%20Environment.%26nbsp%3B%20FWIW%20I%20think%20the%20OneDrive%20ZIP%20is%20when%20user%20Downloads%20several%20docs%20simultaneously%20and%20OneDrive%20Zips%20them%20up.%20(They%20are%20very%20cagey%20on%20the%20phone%20Q's%20like%20these%20get%20bumped%20up%20to%20a%20Level%20Two%20Tech%2C%20who%20may%20or%20may%20not%20answer%20your%20Question%20correctly%20(Assuming%20they%20call%20you%20back)%20.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2109560%22%20slang%3D%22en-US%22%3ERe%3A%20Unified%20Audit%20Logs%20-%20UserAgents%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2109560%22%20slang%3D%22en-US%22%3EThe%20user%20agent%20string%20Onedrivempc%20is%20the%20OneDrive%20for%20Business%20web%20viewer%3C%2FLINGO-BODY%3E
Occasional Visitor

Hi,

I'm doing some work  with SharePoint online, specifically, and am trying to get a handle on the "UserAgent" field. I keep seeing agents which I would like to try and clarify what they are doing or why they appear, hopefully someone can help?

 

OneDriveMpc-Transform_Thumbnail/1.0 - Assume this is when the document is previewed?

OneDriveMpc-Transform_Zip/1.0 - I see this appear multiple times against the same document with the same time stamp.. any ideas?

ODMTAAnalysis/1.0 Interactive - ?

ODMTADemand-Transform_VideoManifest/1.0 - ?

ODMTADemand-Transform_VideoTranscode/1.0 - ?

ODMTADocCache/1.0 - ?

 

Any help would be great,

Cheers

Damian

 

4 Replies

As the user agent is a free text string and can change at any time (or be spoofed), I wouldnt rely on this. I'm not aware of any list that Microsoft published on the above anyway, so all we can offer is some educated guess.

@Holleboom   Having Same issues here, we really would like a List of the User Agent strings  that Microsoft has assigned its Server. (Good Ole Loki)  I doubt MS is going the Spoof their own UAS in their SharePoint/O365 Environment.  FWIW I think the OneDrive ZIP is when user Downloads several docs simultaneously and OneDrive Zips them up. (They are very cagey on the phone Q's like these get bumped up to a Level Two Tech, who may or may not answer your Question correctly (Assuming they call you back) . 

The user agent string Onedrivempc is the OneDrive for Business web viewer