Skip to content

Commit cd24e2c

Browse files
authored
Merge pull request #3838 from MicrosoftDocs/maccruz-oauthprereq
Update advanced-hunting-oauthappinfo-table.md
2 parents 9e3debf + 69d0046 commit cd24e2c

File tree

1 file changed

+7
-0
lines changed

1 file changed

+7
-0
lines changed

defender-xdr/advanced-hunting-oauthappinfo-table.md

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,14 @@ The `OAuthAppInfo` table in the advanced hunting schema contains information abo
3434

3535
The `OAuthAppInfo` table might not include all the app or service principal-related properties that are available on Entra ID. It also does not include data related to Microsoft first-party apps or apps without any OAuth consents. The coverage of the table is based on the existing scope of Microsoft 365-connected apps covered by app governance.
3636

37+
## Prerequisities
3738

39+
This advanced hunting table is populated by app governance records from Microsoft Defender for Cloud Apps. To turn on app governance, follow the steps in [Turn on app governance](/defender-cloud-apps/app-governance-get-started).
40+
41+
If your organization hasn’t deployed Microsoft Defender for Cloud Apps in Microsoft Defender XDR or turned on app governance, queries that use the table aren’t going to work or return any results.
42+
43+
44+
## Schema
3845
For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-schema-tables.md).
3946

4047
| Column name | Data type | Description |

0 commit comments

Comments
 (0)