M365 Change Tracker

← All changes · defender

GA

The following advanced hunting schema tables are now generally available

Why it matters: Generally available

The following advanced hunting schema tables are now generally available: The `IdentityAccountInfo` table contains information about account information from various sources, including Microsoft Entra ID. It also includes information and link to the identity that owns the account. The `EntraIdSignInEvents` table contains information about Microsoft Entra interactive and non-interactive sign-ins. The `EntraIdSpnSignInEvents` table contains information about Microsoft Entra service principal and managed identity sign-ins. The `GraphApiAuditEvents` table provides information about Microsoft Entra ID API requests made to Microsoft Graph API for resources in the tenant.

Source updated 2026-02-01

Affected: Microsoft Defender XDR, Advanced Hunting

View at Microsoft →