|
| 1 | +--- |
| 2 | +title: EntraIdSignInEvents table in the advanced hunting schema (preview) |
| 3 | +description: Learn about the Microsoft Entra sign-in events table of the advanced hunting schema. |
| 4 | +search.appverid: met150 |
| 5 | +ms.service: defender-xdr |
| 6 | +ms.subservice: adv-hunting |
| 7 | +f1.keywords: |
| 8 | + - NOCSH |
| 9 | +ms.author: pauloliveria |
| 10 | +author: poliveria |
| 11 | +ms.localizationpriority: medium |
| 12 | +manager: orspodek |
| 13 | +audience: ITPro |
| 14 | +ms.collection: |
| 15 | +- m365-security |
| 16 | +- tier3 |
| 17 | +ms.custom: |
| 18 | +- cx-ti |
| 19 | +- cx-ah |
| 20 | +appliesto: |
| 21 | + - Microsoft Defender XDR |
| 22 | + - Microsoft Sentinel in the Microsoft Defender portal |
| 23 | +ms.topic: reference |
| 24 | +ms.date: 11/04/2025 |
| 25 | +--- |
| 26 | + |
| 27 | +# EntraIdSignInEvents (Preview) |
| 28 | + |
| 29 | + |
| 30 | + |
| 31 | +> [!IMPORTANT] |
| 32 | +> On December 9, 2025, the `EntraIdSignInEvents` table will replace [`AADSignInEventsBeta`](advanced-hunting-aadsignineventsbeta-table.md). This change will be made to remove the latter's preview status and to align it with the existing product branding. Both tables will coexist until `AADSignInEventsBeta` is deprecated after the said date. |
| 33 | +> |
| 34 | +>To ensure a smooth transition, make sure that you update your queries that use the `AADSignInEventsBeta` table to use `EntraIdSignInEvents` before the previously mentioned date. Your custom detections will be updated automatically and won't require any changes. |
| 35 | +
|
| 36 | +> [!IMPORTANT] |
| 37 | +> Some information relates to prereleased product that may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. |
| 38 | +> |
| 39 | +> Customers need to have a Microsoft Entra ID P2 license to collect and view activities for this table. |
| 40 | +
|
| 41 | +The `EntraIdSignInEvents` table in the advanced hunting schema contains information about Microsoft Entra interactive and non-interactive sign-ins. Learn more about sign-ins in [Microsoft Entra sign-in activity reports - preview](/azure/active-directory/reports-monitoring/concept-all-sign-ins). |
| 42 | + |
| 43 | +Use this reference to construct queries that return information from the table. |
| 44 | + |
| 45 | +For information on other tables in the advanced hunting schema, see the [advanced hunting reference](/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-reference). |
| 46 | + |
| 47 | + |
| 48 | + |
| 49 | + |
| 50 | +|Column name|Data type|Description| |
| 51 | +|---|---|---| |
| 52 | +|`Timestamp`|`datetime`|Date and time when the record was generated| |
| 53 | +|`Application`|`string`|Application that performed the recorded action| |
| 54 | +|`ApplicationId`|`string`|Unique identifier for the application| |
| 55 | +|`LogonType`|`string`|Type of logon session, specifically interactive, remote interactive (RDP), network, batch, and service| |
| 56 | +|`ErrorCode`|`int`|Contains the error code if a sign-in error occurs. To find a description of a specific error code, visit <https://aka.ms/AADsigninsErrorCodes>.| |
| 57 | +|`CorrelationId`|`string`|Identifier of the sign-in event| |
| 58 | +|`SessionId`|`string`|Unique number assigned to a user by a website's server for the duration of the visit or session| |
| 59 | +|`AccountDisplayName`|`string`|Name displayed in the address book entry for the account user. This is usually a combination of the given name, middle initial, and surname of the user.| |
| 60 | +|`AccountObjectId`|`string`|Unique identifier for the account in Microsoft Entra ID| |
| 61 | +|`AccountUpn`|`string`|User principal name (UPN) of the account| |
| 62 | +|`IsExternalUser`|`int`|Indicates if the user that signed in is external. Possible values: -1 (not set), 0 (not external), 1 (external).| |
| 63 | +|`IsGuestUser`|`boolean`|Indicates whether the user that signed in is a guest in the tenant| |
| 64 | +|`AlternateSignInName`|`string`|On-premises user principal name (UPN) of the user signing in to Microsoft Entra ID| |
| 65 | +|`LastPasswordChangeTimestamp`|`datetime`|Date and time when the user that signed in last changed their password| |
| 66 | +|`ResourceDisplayName`|`string`|Display name of the resource accessed. The display name can contain any character.| |
| 67 | +|`ResourceId`|`string`|Unique identifier of the resource accessed| |
| 68 | +|`ResourceTenantId`|`string`|Unique identifier of the tenant of the resource accessed| |
| 69 | +|`DeviceName`|`string`|Fully qualified domain name (FQDN) of the device| |
| 70 | +|`EntraIdDeviceId`|`string`|Unique identifier for the device in Microsoft Entra ID| |
| 71 | +|`OSPlatform`|`string`|Platform of the operating system running on the device. Indicates specific operating systems, including variations within the same family, such as Windows 11, Windows 10, and Windows 7.| |
| 72 | +|`DeviceTrustType`|`string`|Indicates the trust type of the device that signed in. For managed device scenarios only. Possible values are Workplace, AzureAd, and ServerAd.| |
| 73 | +|`IsManaged`|`int`|Indicates whether the device that initiated the sign-in is a managed device (1) or not a managed device (0)| |
| 74 | +|`IsCompliant`|`int`|Indicates whether the device that initiated the sign-in is compliant (1) or non-compliant (0)| |
| 75 | +|`AuthenticationProcessingDetails`|`string`|Details about the authentication processor| |
| 76 | +|`AuthenticationRequirement`|`string`|Type of authentication required for the sign-in. Possible values: multiFactorAuthentication (MFA was required) and singleFactorAuthentication (no MFA was required).| |
| 77 | +|`TokenIssuerType`|`int`|Indicates if the token issuer is Microsoft Entra ID (0) or Active Directory Federation Services (1)| |
| 78 | +|`RiskLevelAggregated`|`int`|Aggregated risk level during sign-in. Possible values: 0 (aggregated risk level not set), 1 (none), 10 (low), 50 (medium), or 100 (high).| |
| 79 | +|`RiskDetails`|`int`|Details about the risky state of the user that signed in| |
| 80 | +|`RiskState`|`int`|Indicates risky user state. Possible values: 0 (none), 1 (confirmed safe), 2 (remediated), 3 (dismissed), 4 (at risk), or 5 (confirmed compromised).| |
| 81 | +|`UserAgent`|`string`|User agent information from the web browser or other client application| |
| 82 | +|`ClientAppUsed`|`string`|Indicates the client app used| |
| 83 | +|`Browser`|`string`|Details about the version of the browser used to sign in| |
| 84 | +|`ConditionalAccessPolicies`|`string`|Details of the conditional access policies applied to the sign-in event| |
| 85 | +|`ConditionalAccessStatus`|`int`|Status of the conditional access policies applied to the sign-in. Possible values are 0 (policies applied), 1 (attempt to apply policies failed), or 2 (policies not applied).| |
| 86 | +|`IPAddress`|`string`|IP address assigned to the device during communication| |
| 87 | +|`Country`|`string`|Two-letter code indicating the country/region where the client IP address is geolocated| |
| 88 | +|`State`|`string`|State where the sign-in occurred, if available| |
| 89 | +|`City`|`string`|City where the account user is located| |
| 90 | +|`Latitude`|`string`|The north to south coordinates of the sign-in location| |
| 91 | +|`Longitude`|`string`|The east to west coordinates of the sign-in location| |
| 92 | +|`NetworkLocationDetails`|`string`|Network location details of the authentication processor of the sign-in event| |
| 93 | +|`RequestId`|`string`|Unique identifier of the request| |
| 94 | +|`ReportId`|`string`|Unique identifier for the event| |
| 95 | +|`EndpointCall`|`string`|Information about the Microsoft Entra ID endpoint that the request was sent to and the type of request sent during sign in.| |
| 96 | + |
| 97 | +## Related articles |
| 98 | + |
| 99 | +- [EntraIdSpnSignInEvents](./advanced-hunting-aadspnsignineventsbeta-table.md) |
| 100 | +- [Advanced hunting overview](/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview) |
| 101 | +- [Learn the query language](/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-language) |
| 102 | +- [Understand the schema](/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference) |
| 103 | + |
| 104 | +[!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)] |
0 commit comments