Merge pull request #4881 from MicrosoftDocs/new-column-EntraIdDeviceId

rebranding of AadDeviceId

Author: guywi-ms

defender-xdr/advanced-hunting-aadsignineventsbeta-table.md

@@ -59,7 +59,8 @@ Use this reference to construct queries that return information from the table.
 |`ResourceId`|`string`|Unique identifier of the resource accessed|
 |`ResourceTenantId`|`string`|Unique identifier of the tenant of the resource accessed|
 |`DeviceName`|`string`|Fully qualified domain name (FQDN) of the device|
-|`AadDeviceId`|`string`|Unique identifier for the device in Microsoft Entra ID|
+|`AadDeviceId`|`string`|Unique identifier of the device in Microsoft Entra ID. This is the legacy device identifier columnn, which is being replaced by `EntraIdDeviceId`.|
+|`EntraIdDeviceId`|`string`|Unique identifier of the device in Microsoft Entra ID.|
 |`OSPlatform`|`string`|Platform of the operating system running on the device. Indicates specific operating systems, including variations within the same family, such as Windows 11, Windows 10, and Windows 7.|
 |`DeviceTrustType`|`string`|Indicates the trust type of the device that signed in. For managed device scenarios only. Possible values are Workplace, AzureAd, and ServerAd.|
 |`IsManaged`|`int`|Indicates whether the device that initiated the sign-in is a managed device (1) or not a managed device (0)|

defender-xdr/advanced-hunting-schema-changes.md

@@ -37,6 +37,9 @@ Naming changes are automatically applied to queries that are saved in Microsoft
 - Queries that are run using the API
 - Queries that are saved elsewhere outside Microsoft Defender XDR
 
+## September 2025
+
+In the [AADSignInEventsBeta](./advanced-hunting-aadspnsignineventsbeta-table.md) table, the `AadDeviceId` column is being replaced with a new column, called `EntraIdDeviceId`, to align with current product branding. The legacy `AadDeviceId` column will remain in the schema for 30 days to allow time for updating in your queries. After this period of 30 days, `AadDeviceId` will be removed from the schema.
 
 ## May 2025
 In the [`IdentityInfo`](advanced-hunting-identityinfo-table.md) table, the `SourceProvider` column was replaced by the `IdentityEnvironment` column. This change was made to streamline the unified `IdentityInfo` table with a similar table in Microsoft Sentinel log analytics. Note that a new column, `SourceProviders` (with an *s*) was added in the unified table. This column refers to the source providers of the accounts for the identity.