9,666 questions
Media Analysis and Transformation Service
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(156.8, 32%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ES%3C/text%3E%3C/svg%3E)
Strategos
65
Reputation points
We are seeing FileAccessed and FilePreviewed events appear in our o365 audit logs with this application id 944f0bd1-117b-4b1c-af26-804ed95e767e, which is owned by the Media Analysis and Transformation Service
These events are logged against active userids with the following user agent strings
ODMTADemand-Transform_Thumbnail/0.0
ODMTADocCache/0.0
OfficeWordCA
We'd like to know if this is a background service which is touching the files on behalf of the user based on some activity in SharePoint or if the user is intentionally accessing the documents. The timestamps against the events are identical in some cases or very close together which makes me think there is a system process at play.
There was a similar question asked here which provide some detail on the service but was hoping for some more clarity. https://learn.microsoft.com/en-us/answers/questions/902074/clarify-role-of-media-analysis-and-transformation
Microsoft 365 and Office | Install, redeem, activate | For business | Windows
Microsoft 365 and Office | SharePoint | For business | Windows
11,701 questions
Microsoft 365 and Office | OneDrive | For business | Windows
2,602 questions
Microsoft Security | Microsoft Entra | Microsoft Entra ID
25,136 questions
1 answer
Sort by: Most helpful
-
Deleted
This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
4 deleted comments
Comments have been turned off. Learn more