What is application information in a cloud event?¶
Application information identifies the software or service that generated or received a cloud event.
It may show a browser, mobile app, desktop sync client, API client, security tool or third-party integration.
What this means in practice¶
An application may act in the background, use delegated permissions or operate through a long-lived token.
Investigators should preserve the application name, application or client ID, publisher, version, permissions, event type and associated session.
An unfamiliar application may indicate compromise, but it may also be legitimate software, automation or a provider component.
What this may show¶
If the application is organisation-managed, obtain the deployment and ownership records. These may show whether the activity was expected, misconfigured or outside the application’s approved purpose.
What this does not show on its own¶
The dangerous assumption is that every event under a user account was performed through the ordinary cloud website.
Do not rely only on the displayed application name. Names can be changed or copied. The underlying client or application ID is usually more reliable.
Where the application used an API, the event may not reflect a person actively using the account at that time.
Where several applications share a common platform component, a generic application label may not identify the final user-facing product. The underlying client ID and publisher records may be needed to separate them.
What to do next¶
Check whether the application was approved, installed, consented to or managed by the organisation.
Compare the event with application-consent logs, token records, device evidence and expected business use.
Key takeaway
Application information explains the software route behind a cloud event, so identify the application ID, permissions and token or session before attributing the action to a user.