Forum Discussion
Unified Audit Logs - UserAgents
Hi,
I'm doing some work with SharePoint online, specifically, and am trying to get a handle on the "UserAgent" field. I keep seeing agents which I would like to try and clarify what they are doing or why they appear, hopefully someone can help?
OneDriveMpc-Transform_Thumbnail/1.0 - Assume this is when the document is previewed?
OneDriveMpc-Transform_Zip/1.0 - I see this appear multiple times against the same document with the same time stamp.. any ideas?
ODMTAAnalysis/1.0 Interactive - ?
ODMTADemand-Transform_VideoManifest/1.0 - ?
ODMTADemand-Transform_VideoTranscode/1.0 - ?
ODMTADocCache/1.0 - ?
Any help would be great,
Cheers
Damian
5 Replies
you want to more about security related audit detail in audit check out.
https://blog.admindroid.com/unified-audit-log-a-guide-to-track-office-365-activities/
- The user agent string Onedrivempc is the OneDrive for Business web viewer
- https://answers.microsoft.com/en-us/msoffice/forum/msoffice_o365admin-mso_security-mso_o365b/about-the-audit-log-useragent/68dbf644-a0be-44e2-9621-0e79b453961c
Holleboom Having Same issues here, we really would like a List of the User Agent strings that Microsoft has assigned its Server. (Good Ole Loki) I doubt MS is going the Spoof their own UAS in their SharePoint/O365 Environment. FWIW I think the OneDrive ZIP is when user Downloads several docs simultaneously and OneDrive Zips them up. (They are very cagey on the phone Q's like these get bumped up to a Level Two Tech, who may or may not answer your Question correctly (Assuming they call you back) .
As the user agent is a free text string and can change at any time (or be spoofed), I wouldnt rely on this. I'm not aware of any list that Microsoft published on the above anyway, so all we can offer is some educated guess.
