{"id":11665,"date":"2025-05-20T04:01:27","date_gmt":"2025-05-19T19:01:27","guid":{"rendered":"https:\/\/m365jp.net\/?p=11665"},"modified":"2025-05-20T04:04:26","modified_gmt":"2025-05-19T19:04:26","slug":"mc1052160-updated-microsoft-defender-xdr-services-changes-to-the-identityinfo-table-in-advanced-hunting","status":"publish","type":"post","link":"https:\/\/m365jp.net\/index.php\/2025-05-20-mc1052160-updated-microsoft-defender-xdr-services-changes-to-the-identityinfo-table-in-advanced-hunting","title":{"rendered":"MC1052160 | (Updated) Microsoft Defender XDR services: Changes to the IdentityInfo table in Advanced Hunting"},"content":{"rendered":"
\n
\n
\n\n\n\n
MC1052160 | (Updated) Microsoft Defender XDR services: Changes to the IdentityInfo table in Advanced Hunting<\/th>\n<\/tr>\n<\/tbody>\n<\/table>\n
\n\n\n\n\n\n\n\n
Classification<\/th>\nplanForChange<\/td>\n<\/tr>\n
Last Updated<\/th>\n05\/19\/2025 18:09:41<\/td>\n<\/tr>\n
Start Time<\/th>\n04\/10\/2025 01:43:17<\/td>\n<\/tr>\n
End Time<\/th>\n08\/29\/2025 07:00:00<\/td>\n<\/tr>\n
Message Content<\/th>\n\n

Updated May 19, 2025: We have updated the content. Thank you for your patience.<\/p>\n

Coming soon: We will unify the Microsoft Defender for Identity (MDI) and Microsoft Sentinel IdentityInfo<\/code> tables in Advanced Hunting into a single table.<\/p>\n

With this unification, we are adding new identity attributes from the Sentinel UEBA service while also adjusting to support third-party Identity Providers (IDPs). Some of these updates include breaking changes, which may require you to update your existing queries. <\/p>\n

<\/p>\n

[When this will happen:]<\/p>\n

General Availability (Worldwide, GCC, GCC High, DoD): We will begin rolling out early May 2025 and expect to complete by late May 2025.<\/p>\n

[How this will affect your organization:]<\/p>\n

After this rollout, identity-related insights will be enriched with these new columns: <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n
Column name<\/th>\n

<\/p>\n

Type<\/th>\n

<\/p>\n

Description<\/th>\n

<\/p>\n

Comment<\/th>\n

<\/tr>\n

<\/p>\n

\n

OnPremObjectId<\/code><\/p>\n<\/td>\n

<\/p>\n

String<\/td>\n

<\/p>\n

Active Directory object ID of the user<\/td>\n

<\/p>\n

New column<\/td>\n

<\/tr>\n

<\/p>\n

\n

TenantMembershipType<\/code><\/p>\n<\/td>\n

<\/p>\n

String<\/td>\n

<\/p>\n

\n

User type in Microsoft Entra ID. Possible values: Guest<\/code>, Member<\/code><\/p>\n<\/td>\n

<\/p>\n

New column<\/td>\n

<\/tr>\n

<\/p>\n

\n

RiskStatus<\/code><\/p>\n<\/td>\n

<\/p>\n

String<\/td>\n

<\/p>\n

\n

Status of the user’s risk. Possible values: None<\/code>, ConfirmedSafe<\/code>, Remediated<\/code>, Dismissed<\/code>, AtRisk<\/code>, ConfirmedCompromised<\/code>, UnknownFutureValue<\/code><\/p>\n<\/td>\n

<\/p>\n

New column<\/td>\n

<\/tr>\n

<\/p>\n

\n

UserAccountControlSettings<\/code><\/p>\n<\/td>\n

<\/p>\n

Dynamic<\/td>\n

<\/p>\n

Security attributes of the user account in Active Directory<\/td>\n

<\/p>\n

New column<\/td>\n

<\/tr>\n

<\/tbody>\n

<\/table>\n<\/p>\n

To help you adjust existing queries,<\/b> this table shows how Sentinel UEBA fields map to the new unified IdentityInfo<\/code> table\u2019s schema:<\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n
Sentinel UEBA Column<\/th>\n

<\/p>\n

Unified IdentityInfo<\/code> Column<\/th>\n

<\/p>\n

Comments<\/th>\n

<\/tr>\n

<\/p>\n

\n

AccountCloudSID<\/code><\/p>\n<\/td>\n

<\/p>\n

\n

CloudSid<\/code><\/p>\n<\/td>\n

<\/p>\n

<\/td>\n

<\/tr>\n

<\/p>\n

\n

AccountSID<\/code><\/p>\n<\/td>\n

<\/p>\n

\n

OnPremSid<\/code><\/p>\n<\/td>\n

<\/p>\n

<\/td>\n

<\/tr>\n

<\/p>\n

\n

AccountCreationTime<\/code><\/p>\n<\/td>\n

<\/p>\n

\n

CreatedDateTime<\/code><\/p>\n<\/td>\n

<\/p>\n

<\/td>\n

<\/tr>\n

<\/p>\n

\n

AccountDisplayName<\/code><\/p>\n<\/td>\n

<\/p>\n

\n

AccountDisplayName<\/code><\/p>\n<\/td>\n

<\/p>\n

<\/td>\n

<\/tr>\n

<\/p>\n

\n

AccountDomain
<\/code><\/p>\n<\/td>\n

\n

AccountDomain
<\/code><\/p>\n<\/td>\n

Values might be different<\/td>\n

<\/tr>\n

<\/p>\n

\n

AccountName
<\/code><\/p>\n<\/td>\n

\n

AccountName<\/code><\/p>\n<\/td>\n

<\/p>\n

Values might be different<\/td>\n

<\/tr>\n

<\/p>\n

\n

AccountTenantId
<\/code><\/p>\n<\/td>\n

\n

TenantId
<\/code><\/p>\n<\/td>\n

<\/tr>\n

<\/p>\n

\n

AccountUPN<\/code><\/p>\n<\/td>\n

<\/p>\n

\n

AccountUpn<\/code><\/p>\n<\/td>\n

<\/p>\n

<\/td>\n

<\/tr>\n

<\/p>\n

\n

AdditionalMailAddresses<\/code><\/p>\n<\/td>\n

<\/p>\n

\n

OtherMailAddresses<\/code><\/p>\n<\/td>\n

<\/p>\n

<\/td>\n

<\/tr>\n

<\/p>\n

\n

MailAddress<\/code><\/p>\n<\/td>\n

<\/p>\n

\n

EmailAddress<\/code><\/p>\n<\/td>\n

<\/p>\n

<\/td>\n

<\/tr>\n

<\/p>\n

\n

OnPremisesDistinguishedName<\/code><\/p>\n<\/td>\n

<\/p>\n

\n

DistinguishedName<\/code><\/p>\n<\/td>\n

<\/p>\n

<\/td>\n

<\/tr>\n

<\/p>\n

\n

SAMAccountName<\/code><\/p>\n<\/td>\n

<\/p>\n

\n

AccountName<\/code><\/p>\n<\/td>\n

<\/p>\n

<\/td>\n

<\/tr>\n

<\/p>\n

\n

StreetAddress<\/code><\/p>\n<\/td>\n

<\/p>\n

\n

Address<\/code><\/p>\n<\/td>\n

<\/p>\n

<\/td>\n

<\/tr>\n

<\/p>\n

\n

UserType<\/code><\/p>\n<\/td>\n

<\/p>\n

\n

TenantMembershipType<\/code><\/p>\n<\/td>\n

<\/p>\n

<\/td>\n

<\/tr>\n

<\/tbody>\n

<\/table>\n<\/p>\n

Breaking Changes
<\/i><\/p>\n

Changes to support third-party identity providers (IDPs):<\/p>\n

    \n
  • To accommodate third-party IDPs, we are modifying these existing columns:<\/li>\n<\/ul>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n\n
    Column Name<\/th>\n

    <\/p>\n

    		Type<\/th>\n

    <\/p>\n

    		Change<\/th>\n

    <\/tr>\n

    <\/p>\n

    \n

    IdentityEnvironment<\/code><\/p>\n<\/td>\n

    <\/p>\n

    		String<\/td>\n

    <\/p>\n

    		\n

    Replaces the SourceProvider<\/code> column. Specifies now the environment where the identity is used. Possible values: CloudOnly<\/code>, Hybrid<\/code>, On-premises<\/code><\/p>\n<\/td>\n

    <\/tr>\n

    <\/p>\n

    \n

    SourceProviders<\/code><\/p>\n<\/td>\n

    <\/p>\n

    		Dynamic<\/td>\n

    <\/p>\n

    		\n

    New column listing identity sources. Possible values: ActiveDirectory<\/code>, EntraID<\/code>, Okta<\/code><\/p>\n<\/td>\n

    <\/tr>\n

    <\/tbody>\n

    <\/table>\n<\/p>\n

    [What you need to do to prepare:]<\/p>\n

    <\/p>\n

    To ensure a smooth transition, we recommend you:<\/p>\n

    Machine Translation<\/th>\n\n

    2025\u5e745\u670819\u65e5\u66f4\u65b0:\u30b3\u30f3\u30c6\u30f3\u30c4\u3092\u66f4\u65b0\u3057\u307e\u3057\u305f\u3002\u3054\u7406\u89e3\u3044\u305f\u3060\u304d\u3042\u308a\u304c\u3068\u3046\u3054\u3056\u3044\u307e\u3059\u3002<\/p>\n

    \u8fd1\u65e5\u516c\u958b\u4e88\u5b9a: Advanced Hunting \u306e Microsoft Defender for Identity (MDI) \u30c6\u30fc\u30d6\u30eb\u3068 Microsoft Sentinel IdentityInfo<\/code> \u30c6\u30fc\u30d6\u30eb\u3092 1 \u3064\u306e\u30c6\u30fc\u30d6\u30eb\u306b\u7d71\u5408\u3057\u307e\u3059\u3002<\/p>\n

    \u3053\u306e\u7d71\u5408\u306b\u3088\u308a\u3001Sentinel UEBA\u30b5\u30fc\u30d3\u30b9\u304b\u3089\u65b0\u3057\u3044ID\u5c5e\u6027\u3092\u8ffd\u52a0\u3059\u308b\u3068\u540c\u6642\u306b\u3001\u30b5\u30fc\u30c9\u30d1\u30fc\u30c6\u30a3\u306eID\u30d7\u30ed\u30d0\u30a4\u30c0\u30fc(IDP)\u3092\u30b5\u30dd\u30fc\u30c8\u3059\u308b\u3088\u3046\u306b\u8abf\u6574\u3057\u3066\u3044\u307e\u3059\u3002\u3053\u308c\u3089\u306e\u66f4\u65b0\u306e\u4e00\u90e8\u306b\u306f\u7834\u58ca\u7684\u5909\u66f4\u304c\u542b\u307e\u308c\u3066\u304a\u308a\u3001\u65e2\u5b58\u306e\u30af\u30a8\u30ea\u306e\u66f4\u65b0\u304c\u5fc5\u8981\u306b\u306a\u308b\u5834\u5408\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n

    <\/p>\n

    [\u3053\u308c\u304c\u3044\u3064\u8d77\u3053\u308b\u304b:]<\/p>\n

    \u4e00\u822c\u63d0\u4f9b (\u5168\u4e16\u754c\u3001GCC\u3001GCC High\u3001DoD): 2025 \u5e74 5 \u6708\u521d\u65ec\u306b\u30ed\u30fc\u30eb\u30a2\u30a6\u30c8\u3092\u958b\u59cb\u3057\u30012025 \u5e74 5 \u6708\u4e0b\u65ec\u307e\u3067\u306b\u5b8c\u4e86\u3059\u308b\u4e88\u5b9a\u3067\u3059\u3002<\/p>\n

    [\u3053\u308c\u304c\u3042\u306a\u305f\u306e\u7d44\u7e54\u306b\u3069\u306e\u3088\u3046\u306b\u5f71\u97ff\u3057\u307e\u3059\u304b:]<\/p>\n

    \u3053\u306e\u30ed\u30fc\u30eb\u30a2\u30a6\u30c8\u5f8c\u3001ID \u95a2\u9023\u306e\u5206\u6790\u60c5\u5831\u306f\u3001\u6b21\u306e\u65b0\u3057\u3044\u5217\u3067\u5f37\u5316\u3055\u308c\u307e\u3059\u3002<\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n
    \u5217\u540d\u3001<\/th>\n

    <\/p>\n

    		\u30bf\u30a4\u30d7<\/th>\n

    <\/p>\n

    		\u3001\u8aac\u660e<\/th>\n

    <\/p>\n

    		\u3001\u30b3\u30e1\u30f3\u30c8<\/th>\n

    <\/tr>\n

    <\/p>\n

    \n

    OnPremObjectId<\/code><\/p>\n<\/td>\n

    <\/p>\n

    		\u7cf8<\/td>\n

    <\/p>\n

    		\u30e6\u30fc\u30b6\u30fc\u306e Active Directory \u30aa\u30d6\u30b8\u30a7\u30af\u30c8 ID<\/td>\n

    <\/p>\n

    		\u65b0\u3057\u3044\u5217<\/td>\n

    <\/tr>\n

    <\/p>\n

    \n

    TenantMembershipType<\/code><\/p>\n<\/td>\n

    <\/p>\n

    		\u7cf8<\/td>\n

    <\/p>\n

    		\n

    Microsoft Entra ID \u306e\u30e6\u30fc\u30b6\u30fc\u5165\u529b\u3002\u53ef\u80fd\u306a\u5024: Guest<\/code>\u3001 Member<\/code><\/p>\n<\/td>\n

    <\/p>\n

    		\u65b0\u3057\u3044\u5217<\/td>\n

    <\/tr>\n

    <\/p>\n

    \n

    RiskStatus<\/code><\/p>\n<\/td>\n

    <\/p>\n

    		\u7cf8<\/td>\n

    <\/p>\n

    		\n

    \u30e6\u30fc\u30b6\u30fc\u306e\u30ea\u30b9\u30af\u306e\u30b9\u30c6\u30fc\u30bf\u30b9\u3002\u53ef\u80fd\u306a\u5024: None<\/code>\u3001 ConfirmedSafe<\/code>\u3001 Remediated<\/code>\u3001 Dismissed<\/code>\u3001 AtRisk<\/code>\u3001 ConfirmedCompromised<\/code>\u3001 UnknownFutureValue<\/code><\/p>\n<\/td>\n

    <\/p>\n

    		\u65b0\u3057\u3044\u5217<\/td>\n

    <\/tr>\n

    <\/p>\n

    \n

    UserAccountControlSettings<\/code><\/p>\n<\/td>\n

    <\/p>\n

    		\u52d5\u7684<\/td>\n

    <\/p>\n

    		Active Directory \u306e\u30e6\u30fc\u30b6\u30fc \u30a2\u30ab\u30a6\u30f3\u30c8\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5c5e\u6027<\/td>\n

    <\/p>\n

    		\u65b0\u3057\u3044\u5217<\/td>\n

    <\/tr>\n

    <\/tbody>\n

    <\/table>\n<\/p>\n

    \u65e2\u5b58\u306e\u30af\u30a8\u30ea\u3092\u8abf\u6574\u3059\u308b\u305f\u3081\u306b\u3001<\/b>\u6b21\u306e\u8868\u306f\u3001Sentinel UEBA\u30d5\u30a3\u30fc\u30eb\u30c9\u304c\u65b0\u3057\u3044\u7d71\u5408IdentityInfo<\/code>\u30c6\u30fc\u30d6\u30eb\u306e\u30b9\u30ad\u30fc\u30de\u306b\u3069\u306e\u3088\u3046\u306b\u30de\u30c3\u30d7\u3055\u308c\u308b\u304b\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n
    Sentinel UEBA\u30b3\u30e9\u30e0<\/th>\n

    <\/p>\n

    		\u7d71\u5408 IdentityInfo<\/code> \u30b3\u30e9\u30e0<\/th>\n

    <\/p>\n

    		\u30b3\u30e1\u30f3\u30c8<\/th>\n

    <\/tr>\n

    <\/p>\n

    \n

    AccountCloudSID<\/code><\/p>\n<\/td>\n

    <\/p>\n

    		\n

    CloudSid<\/code><\/p>\n<\/td>\n

    <\/p>\n

    		<\/td>\n

    <\/tr>\n

    <\/p>\n

    \n

    AccountSID<\/code><\/p>\n<\/td>\n

    <\/p>\n

    		\n

    OnPremSid<\/code><\/p>\n<\/td>\n

    <\/p>\n

    		<\/td>\n

    <\/tr>\n

    <\/p>\n

    \n

    AccountCreationTime<\/code><\/p>\n<\/td>\n

    <\/p>\n

    		\n

    CreatedDateTime<\/code><\/p>\n<\/td>\n

    <\/p>\n

    		<\/td>\n

    <\/tr>\n

    <\/p>\n

    \n

    AccountDisplayName<\/code><\/p>\n<\/td>\n

    <\/p>\n

    		\n

    AccountDisplayName<\/code><\/p>\n<\/td>\n

    <\/p>\n

    		<\/td>\n

    <\/tr>\n

    <\/p>\n

    \n

    AccountDomain
    <\/code><\/p>\n<\/td>\n

    		\n

    AccountDomain
    <\/code><\/p>\n<\/td>\n

    		\u5024\u304c\u7570\u306a\u308b\u5834\u5408\u304c\u3042\u308a\u307e\u3059<\/td>\n

    <\/tr>\n

    <\/p>\n

    \n

    AccountName
    <\/code><\/p>\n<\/td>\n

    		\n

    AccountName<\/code><\/p>\n<\/td>\n

    <\/p>\n

    		\u5024\u304c\u7570\u306a\u308b\u5834\u5408\u304c\u3042\u308a\u307e\u3059<\/td>\n

    <\/tr>\n

    <\/p>\n

    \n

    AccountTenantId
    <\/code><\/p>\n<\/td>\n

    		\n

    TenantId
    <\/code><\/p>\n<\/td>\n

    <\/tr>\n

    <\/p>\n

    \n

    AccountUPN<\/code><\/p>\n<\/td>\n

    <\/p>\n

    		\n

    AccountUpn<\/code><\/p>\n<\/td>\n

    <\/p>\n

    		<\/td>\n

    <\/tr>\n

    <\/p>\n

    \n

    AdditionalMailAddresses<\/code><\/p>\n<\/td>\n

    <\/p>\n

    		\n

    OtherMailAddresses<\/code><\/p>\n<\/td>\n

    <\/p>\n

    		<\/td>\n

    <\/tr>\n

    <\/p>\n

    \n

    MailAddress<\/code><\/p>\n<\/td>\n

    <\/p>\n

    		\n

    EmailAddress<\/code><\/p>\n<\/td>\n

    <\/p>\n

    		<\/td>\n

    <\/tr>\n

    <\/p>\n

    \n

    OnPremisesDistinguishedName<\/code><\/p>\n<\/td>\n

    <\/p>\n

    		\n

    DistinguishedName<\/code><\/p>\n<\/td>\n

    <\/p>\n

    		<\/td>\n

    <\/tr>\n

    <\/p>\n

    \n

    SAMAccountName<\/code><\/p>\n<\/td>\n

    <\/p>\n

    		\n

    AccountName<\/code><\/p>\n<\/td>\n

    <\/p>\n

    		<\/td>\n

    <\/tr>\n

    <\/p>\n

    \n

    StreetAddress<\/code><\/p>\n<\/td>\n

    <\/p>\n

    		\n

    Address<\/code><\/p>\n<\/td>\n

    <\/p>\n

    		<\/td>\n

    <\/tr>\n

    <\/p>\n

    \n

    UserType<\/code><\/p>\n<\/td>\n

    <\/p>\n

    		\n

    TenantMembershipType<\/code><\/p>\n<\/td>\n

    <\/p>\n

    		<\/td>\n

    <\/tr>\n

    <\/tbody>\n

    <\/table>\n<\/p>\n

    \u7834\u58ca\u7684\u5909\u66f4<\/i><\/p>\n

    \u30b5\u30fc\u30c9\u30d1\u30fc\u30c6\u30a3\u306e ID \u30d7\u30ed\u30d0\u30a4\u30c0\u30fc (IDP) \u3092\u30b5\u30dd\u30fc\u30c8\u3059\u308b\u305f\u3081\u306e\u5909\u66f4:<\/p>\n