We found an application named AMC PROD in Azure users sign-in activity logs

Question

We found an application named AMC PROD in Azure users sign-in activity logs

Vinay Bajpyee 0

what user activities or Microsoft services typically generate sign-ins to user account for 'AMC PROD' application (interactive & non interactive).

Can Microsoft confirm the exact authentication flow (modern auth vs legacy, browser vs token-based)?

Is the application using any backend service or API that bypasses Conditional Access evaluation? i could see huge spike in unfamiliar signin due this application for multiples users.

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-08T12:35:09.57+00:00
Hello Vinay Bajpyee,

AMC PROD is a Microsoft-managed application that may appear in Microsoft Entra ID sign-in logs. Because it is an internal Microsoft service, detailed information about its purpose, associated workloads, or the specific user actions that trigger sign-ins is not publicly available.

Based on the application name alone, it is not possible to determine the exact authentication flow or identify the Microsoft service responsible for the sign-in activity.

To better understand the activity, review the sign-in logs for:

Interactive or non-interactive sign-ins

Authentication protocol and client app

Users affected

Target resource

Conditional Access status

Sign-in risk information

Conditional Access evaluation details are available in the sign-in logs and can help determine whether policies were applied to the authentication request.

If you are seeing a spike in sign-ins associated with AMC PROD, examining the related sign-in records should help identify common patterns such as affected users, source applications, and authentication methods. The presence of AMC PROD in the logs by itself does not indicate a security issue.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-09T12:56:53.3866667+00:00

Hello Vinay Bajpyee,

Please confirm if you still have further queries on this
Vinay Bajpyee 0 Reputation points

2026-06-09T17:33:40.85+00:00
I Have checked issue for more few users and observed yet the major (50%) failure logs for these users are from just these two applications 'AMC Prod' & 'OfficeHome'.

Here is some of more details observed in the users signin logs for these applications. where all the logs status is failed & application ID & resource remain same for each failed log.

Application: AMC Prod Application ID: 81feaced-5ddd-41e7-8bef-3e20a2689bb7 Resource: Microsoft Graph

Application: OfficeHome Application ID: 4765445b-32c6-49b0-83e6-1d93765276ca Resource: OfficeHome

Hope it can be possible now to determine the exact authentication flow or identify the Microsoft service responsible for the sign-in activity.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-10T16:38:20.3233333+00:00

Hello Vinay Bajpyee,

Thank you for sharing the application IDs.

AMC Prod (81feaced-5ddd-41e7-8bef-3e20a2689bb7) and OfficeHome (4765445b-32c6-49b0-83e6-1d93765276ca) are Microsoft-managed applications and may appear in Microsoft Entra ID sign-in logs as part of Microsoft's identity and service infrastructure.

The resource information indicates that AMC Prod is requesting access to Microsoft Graph, while OfficeHome is associated with OfficeHome services. However, the application IDs and resource names alone do not provide enough information to determine the exact user action, authentication method, or Microsoft workload that generated the sign-in event. Microsoft does not publicly document the internal workflows behind these applications.

Regarding Conditional Access, there is no known behavior indicating that these applications bypass policy evaluation. Applicable Conditional Access policies are evaluated by Microsoft Entra ID during the authentication process, and the results are reflected in the corresponding sign-in records.

Based on the information provided, the presence of these applications in the sign-in logs is consistent with normal Microsoft service activity and does not, by itself, indicate unauthorized or malicious behavior.

Your answer

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-08T12:35:09.57+00:00

Hello Vinay Bajpyee,

AMC PROD is a Microsoft-managed application that may appear in Microsoft Entra ID sign-in logs. Because it is an internal Microsoft service, detailed information about its purpose, associated workloads, or the specific user actions that trigger sign-ins is not publicly available.

Based on the application name alone, it is not possible to determine the exact authentication flow or identify the Microsoft service responsible for the sign-in activity.

To better understand the activity, review the sign-in logs for:

Interactive or non-interactive sign-ins

Authentication protocol and client app

Users affected

Target resource

Conditional Access status

Sign-in risk information

Conditional Access evaluation details are available in the sign-in logs and can help determine whether policies were applied to the authentication request.

If you are seeing a spike in sign-ins associated with AMC PROD, examining the related sign-in records should help identify common patterns such as affected users, source applications, and authentication methods. The presence of AMC PROD in the logs by itself does not indicate a security issue.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-09T12:56:53.3866667+00:00

Hello Vinay Bajpyee,

Please confirm if you still have further queries on this
Vinay Bajpyee 0 Reputation points

2026-06-09T17:33:40.85+00:00

I Have checked issue for more few users and observed yet the major (50%) failure logs for these users are from just these two applications 'AMC Prod' & 'OfficeHome'.

Here is some of more details observed in the users signin logs for these applications. where all the logs status is failed & application ID & resource remain same for each failed log.

Application: AMC Prod Application ID: 81feaced-5ddd-41e7-8bef-3e20a2689bb7 Resource: Microsoft Graph

Application: OfficeHome Application ID: 4765445b-32c6-49b0-83e6-1d93765276ca Resource: OfficeHome

Hope it can be possible now to determine the exact authentication flow or identify the Microsoft service responsible for the sign-in activity.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-10T16:38:20.3233333+00:00

Hello Vinay Bajpyee,

Thank you for sharing the application IDs.

AMC Prod (81feaced-5ddd-41e7-8bef-3e20a2689bb7) and OfficeHome (4765445b-32c6-49b0-83e6-1d93765276ca) are Microsoft-managed applications and may appear in Microsoft Entra ID sign-in logs as part of Microsoft's identity and service infrastructure.

The resource information indicates that AMC Prod is requesting access to Microsoft Graph, while OfficeHome is associated with OfficeHome services. However, the application IDs and resource names alone do not provide enough information to determine the exact user action, authentication method, or Microsoft workload that generated the sign-in event. Microsoft does not publicly document the internal workflows behind these applications.

Regarding Conditional Access, there is no known behavior indicating that these applications bypass policy evaluation. Applicable Conditional Access policies are evaluated by Microsoft Entra ID during the authentication process, and the results are reflected in the corresponding sign-in records.

Based on the information provided, the presence of these applications in the sign-in logs is consistent with normal Microsoft service activity and does not, by itself, indicate unauthorized or malicious behavior.