Update sign-in events table transition guidance

poliveria · poliveria · commit 95113ec177f2 · 2025-10-15T14:43:30.000+05:30
Clarified that AADSignInEventsBeta and AADSpnSignInEventsBeta tables will be replaced or renamed to EntraIdSignInEvents and EntraIdSpnSignInEvents on November 16, 2025. Added instructions for updating queries and improved transition messaging across related documentation.
diff --git a/defender-xdr/advanced-hunting-aadsignineventsbeta-table.md b/defender-xdr/advanced-hunting-aadsignineventsbeta-table.md
@@ -29,13 +29,18 @@ ms.date: 03/28/2025
 
 
 > [!IMPORTANT]
-> On November 16, 2025, the `AADSignInEventsBeta` table will be renamed to [`EntraIdSignInEvents`](advanced-hunting-entraidsigninevents-table.md). This change will be made to remove the table's preview status and to align it with the existing product branding.
+> On November 16, 2025, the `AADSignInEventsBeta` table will be replaced by [`EntraIdSignInEvents`](advanced-hunting-entraidsigninevents-table.md). This change will be made to remove the former's preview status and to align it with the existing product branding.
 >
-> The `AADSignInEventsBeta` table is currently in beta and is being offered on a short-term basis to allow you to hunt through Microsoft Entra sign-in events. Customers need to have a Microsoft Entra ID P2 license to collect and view activities for this table. All sign-in schema information will eventually move to the `IdentityLogonEvents` table.
+>The `EntraIdSignInEvents` table is already available. To ensure a smooth transition, make sure that you update your queries that use the `AADSignInEventsBeta` table to use `EntraIdSignInEvents` before the previously mentioned date. 
+
+>[!IMPORTANT]
+> The `AADSignInEventsBeta` table is currently in beta and is being offered on a short-term basis to allow you to hunt through Microsoft Entra sign-in events. Customers need to have a Microsoft Entra ID P2 license to collect and view activities for this table.
 
 The `AADSignInEventsBeta` table in the advanced hunting schema contains information about Microsoft Entra interactive and non-interactive sign-ins. Learn more about sign-ins in [Microsoft Entra sign-in activity reports - preview](/azure/active-directory/reports-monitoring/concept-all-sign-ins).
 
-Use this reference to construct queries that return information from the table. For information on other tables in the advanced hunting schema, see the [advanced hunting reference](/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-reference).
+Use this reference to construct queries that return information from the table. 
+
+For information on other tables in the advanced hunting schema, see the [advanced hunting reference](/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-reference).
 
 <br>
 
diff --git a/defender-xdr/advanced-hunting-aadspnsignineventsbeta-table.md b/defender-xdr/advanced-hunting-aadspnsignineventsbeta-table.md
@@ -26,11 +26,13 @@ ms.date: 03/28/2025
 
 # AADSpnSignInEventsBeta
 
-
 > [!IMPORTANT]
-> On November 16, 2025, the `AADSpnSignInEventsBeta` table will be renamed to [`EntraIdSpnSignInEvents`](advanced-hunting-entraidspnsigninevents-table.md). This change will be made to remove the table's preview status and to align it with the existing product branding.
+> On November 16, 2025, the `AADSpnSignInEventsBeta` table will be renamed to [`EntraIdSpnSignInEvents`](advanced-hunting-entraidspnsigninevents-table.md). This change will be made to remove the former's preview status and to align it with the existing product branding.
 >
-> The `AADSpnSignInEventsBeta` table is currently in beta and is being offered on a short-term basis to allow you to hunt through Microsoft Entra sign-in events. Customers need to have a Microsoft Entra ID P2 license to collect and view activities for this table. Microsoft will eventually move all sign-in schema information to the `IdentityLogonEvents` table.
+>The `EntraIdSpnSignInEvents` table is already available. To ensure a smooth transition, make sure that you update your queries that use the `AADSpnSignInEventsBeta` table to use `EntraIdSpnSignInEvents` before the previously mentioned date. 
+
+>[!IMPORTANT]
+>The `AADSpnSignInEventsBeta` table is currently in beta and is being offered on a short-term basis to allow you to hunt through Microsoft Entra sign-in events. Customers need to have a Microsoft Entra ID P2 license to collect and view activities for this table.
 
 The `AADSpnSignInEventsBeta` table in the advanced hunting schema contains information about Microsoft Entra service principal and managed identity sign-ins. You can learn more about the different kinds of sign-ins in [Microsoft Entra sign-in activity reports - preview](/azure/active-directory/reports-monitoring/concept-all-sign-ins).
 
diff --git a/defender-xdr/advanced-hunting-entraidsigninevents-table.md b/defender-xdr/advanced-hunting-entraidsigninevents-table.md
@@ -28,14 +28,23 @@ ms.date: 10/15/2025
 
 
 
+> [!IMPORTANT]
+> On November 16, 2025, the `EntraIdSignInEvents` table will replace [`AADSignInEventsBeta`](advanced-hunting-aadsignineventsbeta-table.md). This change will be made to remove the latter's preview status and to align it with the existing product branding.
+>
+>To ensure a smooth transition, make sure that you update your queries that use the `AADSignInEventsBeta` table to use `EntraIdSignInEvents` before the previously mentioned date. 
+
 > [!IMPORTANT]
 > Some information relates to prereleased product that may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
 >
 > Customers need to have a Microsoft Entra ID P2 license to collect and view activities for this table.
 
 The `EntraIdSignInEvents` table in the advanced hunting schema contains information about Microsoft Entra interactive and non-interactive sign-ins. Learn more about sign-ins in [Microsoft Entra sign-in activity reports - preview](/azure/active-directory/reports-monitoring/concept-all-sign-ins).
 
-Use this reference to construct queries that return information from the table. For information on other tables in the advanced hunting schema, see the [advanced hunting reference](/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-reference).
+Use this reference to construct queries that return information from the table. 
+
+For information on other tables in the advanced hunting schema, see the [advanced hunting reference](/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-reference).
+
+
 
 
 |Column name|Data type|Description|
diff --git a/defender-xdr/advanced-hunting-entraidspnsigninevents-table.md b/defender-xdr/advanced-hunting-entraidspnsigninevents-table.md
@@ -27,14 +27,19 @@ ms.date: 10/15/2025
 # EntraIdSpnSignInEvents (Preview)
 
 
+> [!IMPORTANT]
+> On November 16, 2025, the `EntraIdSpnSignInEvents` table will replace [`AADSpnSignInEventsBeta`](advanced-hunting-aadspnsignineventsbeta-table.md). This change will be made to remove the latter's preview status and to align it with the existing product branding.
+>
+>To ensure a smooth transition, make sure that you update your queries that use the `AADSpnSignInEventsBeta` table to use `EntraIdSpnSignInEvents` before the previously mentioned date. 
+
 > [!IMPORTANT]
 > Some information relates to prereleased product that may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
 >
 > Customers need to have a Microsoft Entra ID P2 license to collect and view activities for this table.
 
 The `EntraIdSpnSignInEvents` table in the advanced hunting schema contains information about Microsoft Entra service principal and managed identity sign-ins. You can learn more about the different kinds of sign-ins in [Microsoft Entra sign-in activity reports - preview](/azure/active-directory/reports-monitoring/concept-all-sign-ins).
 
-Use this reference to construct queries that return information from the table.
+Use this reference to construct queries that return information from the table. 
 
 For information on other tables in the advanced hunting schema, see [the advanced hunting reference](/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-reference).
 
diff --git a/defender-xdr/advanced-hunting-schema-changes.md b/defender-xdr/advanced-hunting-schema-changes.md
@@ -37,6 +37,12 @@ Naming changes are automatically applied to queries that are saved in Microsoft
 - Queries that are run using the API
 - Queries that are saved elsewhere outside Microsoft Defender XDR
 
+## October 2025
+
+The [`AADSignInEventsBeta`](advanced-hunting-aadspnsignineventsbeta-table.md) and  [`AADSignInEventsBeta`](advanced-hunting-aadspnsignineventsbeta-table.md) tables are being replaced by [`EntraIdSignInEvents`](advanced-hunting-entraidsigninevents-table.md) and [`EntraIdSpnSignInEvents`](advanced-hunting-entraidspnsigninevents-table.md), respectively. These changes are being made to remove the former tables' preview status and to align them with the existing product branding.
+
+The `EntraIdSignInEvents` and `EntraIdSpnSignInEvents` tables are now available. The legacy `AADSignInEventsBeta`and `AADSignInEventsBeta` tables will remain in the schema for 30 days to allow time for updating your queries. After this period of 30 days, `AADSignInEventsBeta`and `AADSignInEventsBeta` will be removed from the schema.
+
 ## September 2025
 
 In the [AADSignInEventsBeta](./advanced-hunting-aadspnsignineventsbeta-table.md) table, the `AadDeviceId` column is being replaced with a new column, called `EntraIdDeviceId`, to align with current product branding. The legacy `AadDeviceId` column will remain in the schema for 30 days to allow time for updating in your queries. After this period of 30 days, `AadDeviceId` will be removed from the schema.
