Sharepoint audit log

Question

![](https://learn-attachment.microsoft.com/api/attachments/16b3b465-781f-4745-a4ca-10f50fa9df30?platform=QnA![](https://learn-attachment.microsoft.com/api/attachments/b2e8e502-55a8-44af-be8b-ca1cdc805275?platform=QnA

The logs indicate that five documents were accessed simultaneously at the same time (same millisecond) 11:49:31 am, saved in three different folders and that too from a single device. All the documents have the same IP address, which means they were all accessed from the same device. I struggled to understand how a user can access 5 documents from 3 different folders on a single device at the same time. It is practically impossible for a human. Can you explain when this can occur? 

• Microsoft specifies that if we open the file which is stored in SharePoint Online using Office client, we will see "Microsoft Office PowerPoint 2014 (16.0.7726) Windows NT 6.3" in User Agent and if in browser the UserAgent will show Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; rv:11.0) like Gecko. The user agents in the logs are ODMTADocCache/0.0,OfficeWordCA and ODMTADemand-Transform_Thumbnail/0.0.   So, does this mean that the above user agents indicate that the file was not accessed/opened/read by the user but the background process?
• I have usually seen the platform as “WinDesktop” where files were accessed but the audit logs show the platform as "Service" (for files accessed) or “Not unspecified” (for files previewed). Does this mean the document is accessed by the background process?
• Similarly, the logs show OAuth entry in the “authentication type” column whereas when files are accessed by the user, it shows as FormsCookieAuth. Again, does this indicate that it was a background process?
• When the Application display name in the logs is Media Analysis and Transformation Service, does it mean it’s a background service?
• Is sharepoint audit logs able to provide the details of the unmanaged device and the user type for all file access (even the ones accessed by background process)? What would be the user type if the file is accessed by a background user?
• If the logs are accessed by background processes, do the audit logs return blank for user agent, browser name and version data.

Answer 1

Dear tech_fc,

1. It's likely indicating these user agents do not correspond to typical browser or Office client software. The interaction with the file was by a service or background process rather than a direct user action.
2. When the audit logs show the platform as “Service,” it's likely indicating a service account or background process accessed the file, as opposed to “WinDesktop,” which suggests a user on a Windows desktop application.
3. "OAuth" in the authentication type column suggests that the access token used for authentication was obtained through the OAuth protocol, which is a common method for service-to-service authentication. "FormsCookieAuth" would typically represent interactive user authentication via a web form where a cookie is used for maintaining the session.
4. If the Application display name in the logs is "Media Analysis and Transformation Service," it likely means the activity was performed by a background service that processes media files for analysis and transformation purposes.
5. SharePoint audit logs do provide information on the device and user type, but there might be limitations regarding the granularity of the details for unmanaged devices or background processes. The user type for a background process could be listed as a service account or system account, or it might not be specified at all.
6. If the logs are generated by background processes, certain fields like user agent, browser name, and version might indeed be blank or contain generic identifiers that represent the service rather than specific browser details.

Sincerely,

Jazlyn | Microsoft Community Moderator

Answer 2

Thank you for your response. Could you also respond to the remaining queries -

• Microsoft specifies that if we open the file which is stored in SharePoint Online using Office client, we will see "Microsoft Office PowerPoint 2014 (16.0.7726) Windows NT 6.3" in User Agent and if in browser the UserAgent will show Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; rv:11.0) like Gecko. The user agents in the logs are ODMTADocCache/0.0,OfficeWordCA and ODMTADemand-Transform_Thumbnail/0.0.   So, does this mean that the above user agents indicate that the file was not accessed/opened/read by the user but the background process?
• I have usually seen the platform as “WinDesktop” where files were accessed but the audit logs show the platform as "Service" (for files accessed) or “Not unspecified” (for files previewed). Does this mean the document is accessed by the background process?
• Similarly, the logs show OAuth entry in the “authentication type” column whereas when files are accessed by the user, it shows as FormsCookieAuth. Again, does this indicate that it was a background process?
• When the Application display name in the logs is Media Analysis and Transformation Service, does it mean it’s a background service?
• Is sharepoint audit logs able to provide the details of the unmanaged device and the user type for all file access (even the ones accessed by background process)? What would be the user type if the file is accessed by a background user?
• If the logs are accessed by background processes, do the audit logs return blank for user agent, browser name and version data.

Answer 3

Dear tech_fc,

Good day! Thank you for posting your query in our community.

It is possible that the simultaneous access to multiple documents from different folders on a single device was done by a background process or an automated script. However, I couldn't find any related article mentioning those values.

If you want to confirm it,  we suggest you raise a support ticket from the Office 365 admin center, where the related team will answer your concern. Reference: Get support - Microsoft 365 admin | Microsoft Learn

Note: To create a support ticket, you need to have admin privileges and if you aren’t admin of your Office 365 organization, please contact the admin of creating a new ticket.

Appreciate your understanding.

Sincerely,

Jazlyn | Microsoft Community Moderator

Answer 4

Dear Friends,

Good morning!

Thank you for posting in the Microsoft Community. We will be happy to help you. We are investigating your situation and will let you know soon.

Appreciate their patience and understanding and thank them for their time and cooperation.

Sincerely

Stacey