topic Re: No ms-onedrive-uploading or downloading Appl activity--it is all ms-onedrive-base in General Topics

No ms-onedrive-uploading or downloading Appl activity--it is all ms-onedrive-base

Royalfr — Fri, 14 Jul 2023 19:03:17 GMT

We don't allow ms-onedrive-uploading. Some IT have UserID-based right to ms-onedrive-base & ms-onedrive-downloading.

Despite all of those up-privileged users showing "ms-onedrive-base" activity--nobody shows downloading. It was brought to our attention that they can upload to onedrive which is showing up as "ms-onedrive-base" only. And the filenames being uploaded within the web interface are being obfuscated.

Are others seeing uploading occuring under ms-onedrive-base??

I wonder if this is just that MS has altered the function and PA's userID is no longer functionally existent. I have to do my own testing as no logs were retained and info is too generic for my liking. Perhaps the AppID is only valid for the onedrive application you install in Windows and not the website.

Re: No ms-onedrive-uploading or downloading Appl activity--it is all ms-onedrive-base

reaper — Mon, 31 Jul 2023 09:00:45 GMT

do you have ssl decryption enabled for these flows?

onedrive depends on ssl and uploading/downloading can only be detected if you're decrypting the session

Re: No ms-onedrive-uploading or downloading Appl activity--it is all ms-onedrive-base

BPry — Mon, 31 Jul 2023 15:20:07 GMT

@Royalfr,

Just to piggyback off of what @reaper already mentioned, and I suspect is the proper answer to why you aren't seeing this traffic, I just wanted to verify that on 8736-8195 this traffic is being properly identified as ms-onedrive-uploading with the web client and the OneDrive client when the traffic is being decrypted.