Merge pull request #3879 from MicrosoftDocs/main

[AutoPublish] main to live - 05/23 10:31 PDT | 05/23 23:01 IST

Author: Ruchika-mittal01

defender-xdr/advanced-hunting-oauthappinfo-table.md

@@ -19,8 +19,9 @@ ms.custom:
 - cx-ah
 appliesto:
     - Microsoft Defender XDR
+    - Microsoft Sentinel in the Microsoft Defender portal
 ms.topic: reference
-ms.date: 04/01/2025
+ms.date: 05/23/2025
 ---
 
 # OAuthAppInfo (Preview)
@@ -32,13 +33,13 @@ ms.date: 04/01/2025
 
 The `OAuthAppInfo` table in the advanced hunting schema contains information about Microsoft 365-connected OAuth applications in the organization that are registered with Microsoft Entra ID and available in the Microsoft Defender for Cloud Apps app governance capability. 
 
-The `OAuthAppInfo` table might not include all the app or service principal-related properties that are available on Entra ID. It also does not include data related to Microsoft first-party apps or apps without any OAuth consents. The coverage of the table is based on the existing scope of Microsoft 365-connected apps covered by app governance. 
+The `OAuthAppInfo` table might not include all the app or service principal-related properties that are available on Entra ID. It also doesn't include data related to Microsoft first-party apps or apps without any OAuth consents. The coverage of the table is based on the existing scope of Microsoft 365-connected apps covered by app governance. 
 
-## Prerequisities
+## Prerequisites
 
 This advanced hunting table is populated by app governance records from Microsoft Defender for Cloud Apps. To turn on app governance, follow the steps in [Turn on app governance](/defender-cloud-apps/app-governance-get-started).
 
-If your organization hasn’t deployed Microsoft Defender for Cloud Apps in Microsoft Defender XDR or turned on app governance, queries that use the table aren’t going to work or return any results.
+If your organization hasn’t deployed Microsoft Defender for Cloud Apps in Microsoft Defender XDR nor turned on app governance, you can't view the `OAuthAppInfo` table in advanced hunting.
 
 
 ## Schema
@@ -57,7 +58,7 @@ For information on other tables in the advanced hunting schema, see [the advance
 | `VerifiedPublisher` | `dynamic` | Specifies details about the verified publisher of the application which this service principal represents. It includes information such as: DisplayName, VerifiedPublisherId, AddedDateTime|
 | `PrivilegeLevel` | `string` | The privilege level of the app based on the highest classified permission granted to the app|
 | `Permissions` | `dynamic` | Contains an array of permission objects; each permission object includes PermissionName, TargetAppId, TargetAppDisplayName, PermissionType, PrivilegeLevel, UsageStatus|
-| `ConsentedUsersCount` | `integer` | Count of users who have consented to the app; this information is only available when the app is not admin consented|
+| `ConsentedUsersCount` | `integer` | Count of users who have consented to the app; this information is only available when the app isn't admin consented|
 | `IsAdminConsented` | `boolean` | Value is True if a user has provided admin consent to the app on behalf of all the users in the org, otherwise the value is False|
 | `AppOrigin` | `string` | Specifies whether the app is internal to the organization or registered in an external tenant|
 | `LastUsedTime` | `datetime` | Date and time when the app was last used|