Đọc bằng tiếng Anh

Chia sẻ qua

UserAgent property value in the unified audit log from the Security & Compliance Center

  • Bài viết
  • Áp dụng cho:
    Exchange Online

Original KB number: 4487380

Summary

When you pull the unified audit log from the Office 365 Security & Compliance Center for successful or failed sign-in, you see the following value for the UserAgent property. This article explains what the information refers to.

"Name":"UserAgent","**Value**":"**CBAInPROD**"

The details of the audit log may resemble the following:

{'CreationTime':'YYYY-MM-DD','Id':'GUID','Operation':'UserLoginFailed','OrganizationId': 'OrganizationId','RecordType':15,'ResultStatus':'Failed','UserKey':'10037FFE8BE14EC8@contoso.com', 'UserType':0,'Version':1,'Workload':'AzureActiveDirectory','ClientIP':'192.168.0.1','ObjectId':'Unknown','UserId':'user@contoso.com', 'AzureActiveDirectoryEventType':1,'ExtendedProperties':[{'Name':'UserAgent','Value':'CBAInPROD'}

More information

User agent usually refers to the information about the user's browser. In this particular case, it indicates that you use a legacy protocol such as POP or IMAP to access your mailbox.

Legacy email clients use Basic authentication. Basic authentication in Exchange Online accepts a user name and a password for client access requests. Blocking Basic authentication can help protect an Exchange Online organization from brute force or password spray attacks. To block basic authentication, see Disable Basic authentication in Exchange Online.