Dear Falk n1
Thanks for choosing Microsoft Community.
Based on your description, I know your consult. For this, the "Client=REST;Client=RESTSystem" entry in the Mailbox audit logs indicates that the action was performed using the REST API. The REST API is a web-based API that allows developers to interact with Microsoft 365 services, including Exchange Online, using HTTP requests.
In your case, it appears that the invite was sent using the REST API through the Outlook client. The app ID you mentioned is likely the ID of the application that was used to send the invite.
The reason why this information appears in the Mailbox audit logs is to provide a record of all actions performed on the mailbox. This information can be useful for troubleshooting issues or investigating security incidents.
Hope this can help. If there is any update, please feel free to let me know. I will continue to assist you based on the information you provide. Your understanding and cooperation are highly appreciated.
Thanks for your precious time. Have a nice day.
Sincerely,
Katherine