{
  "d3590ed6-52b3-4102-aeff-aad2292ab01c": {
    "name": "Microsoft Office",
    "publisher": "Microsoft",
    "type": "first-party",
    "notes": "Universal Office desktop client ID used across every tenant. Frequently the top EWS caller in Microsoft's own usage reports; confirmed by Microsoft as the 'first party Microsoft Office app' still using EWS internally.",
    "source": "Microsoft Tech Community"
  },
  "8d3a7d3c-c034-4f19-a2ef-8412952a9671": {
    "name": "MicrosoftOffice",
    "publisher": "Microsoft",
    "type": "first-party",
    "notes": "Alternate Office-family first-party app ID seen in some tenants.",
    "source": "community"
  },
  "f8d98a96-0999-43f5-8af3-69971c7bb423": {
    "name": "iOS Accounts",
    "publisher": "Microsoft",
    "type": "first-party",
    "notes": "Account/auth component used by Outlook for iOS.",
    "source": "community"
  },
  "27922004-5251-4030-b22d-91ecd9a37ea4": {
    "name": "Outlook Mobile",
    "publisher": "Microsoft",
    "type": "first-party",
    "notes": "Outlook for iOS/Android client.",
    "source": "Microsoft Learn - verify first-party apps in sign-in reports"
  },
  "5d661950-3475-41cd-a2c3-d671a3162bc1": {
    "name": "Microsoft Outlook",
    "publisher": "Microsoft",
    "type": "first-party",
    "notes": "Outlook desktop client identity used in some sign-in scenarios.",
    "source": "community"
  },
  "bc59ab01-8403-45c6-8796-ac3ef710b3e3": {
    "name": "Outlook Online Add-in App",
    "publisher": "Microsoft",
    "type": "first-party",
    "notes": "Outlook on the web / OWA add-in platform.",
    "source": "community"
  },
  "93d53678-613d-4013-afc1-62e9e444a0a5": {
    "name": "Office on the web",
    "publisher": "Microsoft",
    "type": "first-party",
    "notes": "Office web apps.",
    "source": "community"
  },
  "e48d4214-364e-4731-b2b6-47dabf529218": {
    "name": "Skype Web",
    "publisher": "Microsoft",
    "type": "first-party",
    "notes": "Legacy Skype web client identity, occasionally still seen calling Exchange for presence/free-busy.",
    "source": "community"
  },
  "cc15fd57-2c6c-4117-a88c-83b1d56b4bbe": {
    "name": "Microsoft Teams Services",
    "publisher": "Microsoft",
    "type": "first-party",
    "notes": "Backend Teams service calling Exchange for calendar/free-busy integration.",
    "source": "community"
  },
  "fa7ff576-8e31-4a58-a5e5-780c1cd57caa": {
    "name": "OneNote",
    "publisher": "Microsoft",
    "type": "first-party",
    "notes": "OneNote client, occasionally touches Exchange for linked-notes/email features.",
    "source": "community"
  },
  "a0c73c16-a7e3-4564-9a95-2bdf47383716": {
    "name": "Exchange Management Shell (PowerShell)",
    "publisher": "Microsoft",
    "type": "first-party",
    "notes": "Admin PowerShell connections to Exchange Online; not a mail client, but can appear in usage data if cmdlets touch EWS-backed cmdlets.",
    "source": "community"
  },
  "1b730954-1685-4b74-9bfd-dac224a7b894": {
    "name": "Microsoft Graph / Global PowerShell (Azure AD Module)",
    "publisher": "Microsoft",
    "type": "first-party",
    "notes": "Very common first-party ID reused by Azure AD/MSOnline/Graph PowerShell modules under the hood.",
    "source": "community"
  },
  "00000002-0000-0ff1-ce00-000000000000": {
    "name": "Office 365 Exchange Online",
    "publisher": "Microsoft",
    "type": "first-party",
    "notes": "Exchange Online's own resource app ID (the service itself, not a client). Seeing this as the caller usually indicates a server-to-server or delegated scenario.",
    "source": "Microsoft Learn"
  },
  "00000003-0000-0000-c000-000000000000": {
    "name": "Microsoft Graph",
    "publisher": "Microsoft",
    "type": "first-party",
    "notes": "Microsoft Graph resource app ID.",
    "source": "Microsoft Learn"
  },
  "af08ce07-1df9-4a39-b6e6-092ac934eb21": {
    "name": "Synology Active Backup for Office 365",
    "publisher": "Synology",
    "type": "third-party-isv",
    "notes": "NAS-based Microsoft 365 backup product. Authenticates via EWS to pull mailbox data. Legitimate if your org runs Synology backup; confirm it is an authorized job.",
    "source": "community"
  }
}