Office 365 personal account activity is being misreported

Products

• CASB Gateway Advanced
• CASB Gateway
• CASB Security Advanced
• CASB Security Premium
• CASB Security Standard

Issue/Introduction

O365 Gatelet is reporting Cloud Service User logged into personal account reporting internal activity.

• User logs into session - Reports correctly as internal user
• User logs into personal O365 account during session - Reports correctly as external log in
• User performs action within personal account - Report incorrectly as internal activity 

 

Environment

CloudSOC 3.157

Resolution

Engineering implemented a fix in the CloudSOC 3.157 update and included in the release notes (fixed issues for Gateway). 

Verified the fix for both Outlook web app and desktop app. For an external account, investigate logs are showing correct cloud service username and account type as External.