What does the O365 service "Office Shredding Service" do?

Question

Hi all, Sentinel flagged an alert about a 'New User Agent Observed', with the user agent being 'Office Shredding Service' (categorised under OfficeActivity in the logs). The activity was tied to a user within the organisation.

The reported operation was 'FilePreviewed', which made it a bit more complicated, as the other logs for previewed files were categorised as 'SharePointFileOperation'. I've researched as much as I could find on the Internet, but all I could discover was that it was a pre-installed Office 365 service. I couldn't find any details as to what the service actually does.

Does anyone know what this service is responsible for, and the difference between 'Office Shredding Service' and 'SharePointFileOperation'?

Answer 1

Hi Nick,

It looks like a Microsoft first-party application (something they named a service):

https://github.com/MicrosoftDocs/SupportArticles-docs/blob/main/support/azure/active-directory/verify-first-party-apps-sign-in.md

I've seen some threads out there stating that it has to do with Web client (Outlook for Web) but am not for certain.

Answer 2

Hi @Nick3680 ，

I agree with Dillon Silzer.

After my internal and external searches, there is currently no official documentation that clearly states this.

I found a similar thread you can check:https://answers.microsoft.com/en-us/msoffice/forum/all/what-is-officeshredderwacclient/1095152a-c56f-479c-b978-c9c44fba7920

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.