Merge pull request #4977 from MicrosoftDocs/main

[AutoPublish] main to live - 09/09 01:34 PDT | 09/09 14:04 IST

Author: m365-skilling-repo-management[bot]

defender-endpoint/api/get-all-recommendations.md

@@ -15,7 +15,7 @@ ms.topic: reference
 ms.subservice: reference
 ms.custom: api
 search.appverid: met150
-ms.date: 12/18/2020
+ms.date: 03/18/2025
 ---
 
 # List all recommendations
@@ -35,8 +35,6 @@ ms.date: 12/18/2020
 
 [!include[Improve request performance](../../includes/improve-request-performance.md)]
 
-[!include[Prerelease information](../../includes/prerelease.md)]
-
 Retrieves a list of all security recommendations affecting the organization.
 
 

defender-endpoint/api/get-all-vulnerabilities.md

@@ -15,7 +15,7 @@ ms.topic: reference
 ms.subservice: reference
 ms.custom: api
 search.appverid: met150
-ms.date: 12/18/2020
+ms.date: 03/18/2025
 ---
 
 # List vulnerabilities
@@ -34,8 +34,6 @@ ms.date: 12/18/2020
 
 [!include[Improve request performance](../../includes/improve-request-performance.md)]
 
-[!include[Prerelease information](../../includes/prerelease.md)]
-
 ## API description
 
 Retrieves a list of all vulnerabilities.

defender-endpoint/live-response-command-examples.md

@@ -93,16 +93,16 @@ fileinfo C:\Windows\notepad.exe
 findfile test.txt
 ```
 
-## `getfile`
+## `get`
 
 ```console
 # Download a file from a machine
-getfile c:\Users\user\Desktop\work.txt
+get c:\Users\user\Desktop\work.txt
 ```
 
 ```console
 # Download a file from a machine, automatically run prerequisite commands
-getfile c:\Users\user\Desktop\work.txt -auto
+get c:\Users\user\Desktop\work.txt -auto
 ```
 
 > [!NOTE]

defender-xdr/advanced-hunting-aadsignineventsbeta-table.md

@@ -59,7 +59,8 @@ Use this reference to construct queries that return information from the table.
 |`ResourceId`|`string`|Unique identifier of the resource accessed|
 |`ResourceTenantId`|`string`|Unique identifier of the tenant of the resource accessed|
 |`DeviceName`|`string`|Fully qualified domain name (FQDN) of the device|
-|`AadDeviceId`|`string`|Unique identifier for the device in Microsoft Entra ID|
+|`AadDeviceId`|`string`|Unique identifier of the device in Microsoft Entra ID. This is the legacy device identifier columnn, which is being replaced by `EntraIdDeviceId`.|
+|`EntraIdDeviceId`|`string`|Unique identifier of the device in Microsoft Entra ID.|
 |`OSPlatform`|`string`|Platform of the operating system running on the device. Indicates specific operating systems, including variations within the same family, such as Windows 11, Windows 10, and Windows 7.|
 |`DeviceTrustType`|`string`|Indicates the trust type of the device that signed in. For managed device scenarios only. Possible values are Workplace, AzureAd, and ServerAd.|
 |`IsManaged`|`int`|Indicates whether the device that initiated the sign-in is a managed device (1) or not a managed device (0)|

defender-xdr/advanced-hunting-schema-changes.md

@@ -37,6 +37,9 @@ Naming changes are automatically applied to queries that are saved in Microsoft
 - Queries that are run using the API
 - Queries that are saved elsewhere outside Microsoft Defender XDR
 
+## September 2025
+
+In the [AADSignInEventsBeta](./advanced-hunting-aadspnsignineventsbeta-table.md) table, the `AadDeviceId` column is being replaced with a new column, called `EntraIdDeviceId`, to align with current product branding. The legacy `AadDeviceId` column will remain in the schema for 30 days to allow time for updating in your queries. After this period of 30 days, `AadDeviceId` will be removed from the schema.
 
 ## May 2025
 In the [`IdentityInfo`](advanced-hunting-identityinfo-table.md) table, the `SourceProvider` column was replaced by the `IdentityEnvironment` column. This change was made to streamline the unified `IdentityInfo` table with a similar table in Microsoft Sentinel log analytics. Note that a new column, `SourceProviders` (with an *s*) was added in the unified table. This column refers to the source providers of the accounts for the identity.