We are analyzing the unified audit logs from SharePoint and some records have a ClientIP that when resolved, point to a location where the user could not have possibly been. For example, our company is based in Africa, but the IP address of some users show as being in Ireland or India.

This seems to be the case when user agents are "onenotemodernsynccontentsync".

So why is the IP address being recorded as Microsoft Corporation in a foreign country instead of the actual user's ISP IP address like all other records?

  • Are you using VPN clients with some companies? Or co-working on OneNote with another users? – Zdeněk Vinduška Aug 1 '19 at 13:32
  • No VPN usage here, just normal syncing of OneNote 2016 on Windows 10. @Zdeněk Vinduška – Kyle Champion Aug 5 '19 at 15:08

When you open Microsoft OneNote, the program synchronizes your notebooks with SharePoint Online.

This process goes through a user agent that can be identified by either onenotemodernsynccontentsync or onenotemodernsynccontentono.

The detail recorded in the unified audit logs shows as FileAccessed, with the IP address being the server handling the synchronization.

Ultimately, this could be India, Ireland, America or any other foreign country that has the capacity at the time to handle it.


This has been confirmed in a support call with Microsoft that these are load balancing or system operations; and they are in fact occurring on Microsoft systems.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.