Media Analysis and Transformation Service

Strategos 65 Reputation points
2023-09-06T12:47:11.7866667+00:00

We are seeing FileAccessed and FilePreviewed events appear in our o365 audit logs with this application id 944f0bd1-117b-4b1c-af26-804ed95e767e, which is owned by the Media Analysis and Transformation Service

These events are logged against active userids with the following user agent strings

ODMTADemand-Transform_Thumbnail/0.0

ODMTADocCache/0.0

OfficeWordCA

We'd like to know if this is a background service which is touching the files on behalf of the user based on some activity in SharePoint or if the user is intentionally accessing the documents. The timestamps against the events are identical in some cases or very close together which makes me think there is a system process at play.

There was a similar question asked here which provide some detail on the service but was hoping for some more clarity. https://learn.microsoft.com/en-us/answers/questions/902074/clarify-role-of-media-analysis-and-transformation

Microsoft 365 and Office | Install, redeem, activate | For business | Windows
Microsoft 365 and Office | SharePoint | For business | Windows
Microsoft 365 and Office | OneDrive | For business | Windows
Microsoft Security | Microsoft Entra | Microsoft Entra ID
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

    4 deleted comments

    Comments have been turned off. Learn more

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.