I am in Microsoft Azure Sentinel running a query against that OfficeActivity table. Guids are showing up in the ClientAppId column. I want to use these IDs to lookup details of the client application, however I cannot find a corresponding application in either the App Registration table nor the Enterprise Applications table.
Where else could these ClientAppIds be found?
Query:
OfficeActivity
| where ClientAppId != ""