Skip to content

Commit d8cfac0

Browse files
committed
docs for oauthappinfo
1 parent 3e38931 commit d8cfac0

File tree

4 files changed

+23
-9
lines changed

4 files changed

+23
-9
lines changed

defender-xdr/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -306,6 +306,8 @@
306306
href: advanced-hunting-identitylogonevents-table.md
307307
- name: IdentityQueryEvents
308308
href: advanced-hunting-identityqueryevents-table.md
309+
- name: OAuthAppInfo
310+
href: advanced-hunting-oauthappinfo-table.md
309311
- name: UrlClickEvents
310312
href: advanced-hunting-urlclickevents-table.md
311313
- name: Custom detections

defender-xdr/advanced-hunting-oauthappinfo-table.md

Lines changed: 16 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
title: OAuthAppInfo table in the advanced hunting schema
3-
description: Learn about the
3+
description: Learn about the OAuthAppInfo table which contains information about Microsoft 365-connected OAuth applications registered with Microsoft Entra ID and available in the Defender for Cloud Apps app governance capability.
44
search.appverid: met150
55
ms.service: defender-xdr
66
ms.subservice: adv-hunting
@@ -17,21 +17,23 @@ ms.collection:
1717
ms.custom:
1818
- cx-ti
1919
- cx-ah
20+
appliesto:
21+
- Microsoft Defender XDR
2022
ms.topic: reference
21-
ms.date: 03/12/2025
23+
ms.date: 04/01/2025
2224
---
2325

24-
# OAuthAppInfo
26+
# OAuthAppInfo (Preview)
2527

2628
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
2729

28-
29-
30-
3130
> [!IMPORTANT]
3231
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
3332
34-
The `DeviceBaselineComplianceAssessment` table in the advanced hunting schema contains baseline compliance assessment snapshot, which indicates the status of various security configurations related to baseline profiles on devices.
33+
The `OAuthAppInfo` table in the advanced hunting schema contains information about Microsoft 365-connected OAuth applications in the organization that are registered with Microsoft Entra ID and available in the Microsoft Defender for Cloud Apps app governance capability.
34+
35+
The `OAuthAppInfo` table might not include all the app or service principal-related properties that are available on Entra ID. It also does not include data related to Microsoft first-party apps or apps without any OAuth consents. The coverage of the table is based on the existing scope of Microsoft 365-connected apps covered by app governance.
36+
3537

3638
For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-schema-tables.md).
3739

@@ -50,9 +52,14 @@ For information on other tables in the advanced hunting schema, see [the advance
5052
| `Permissions` | `dynamic` | Contains an array of permission objects; each permission object includes PermissionName, TargetAppId, TargetAppDisplayName, PermissionType, PrivilegeLevel, UsageStatus|
5153
| `ConsentedUsersCount` | `integer` | Count of users who have consented to the app; this information is only available when the app is not admin consented|
5254
| `IsAdminConsented` | `boolean` | Value is True if a user has provided admin consent to the app on behalf of all the users in the org, otherwise the value is False|
53-
| `AppOrigin` | `string` | Specifies whether was the app is internal to the organization or registered in an external tenant|
55+
| `AppOrigin` | `string` | Specifies whether the app is internal to the organization or registered in an external tenant|
5456
| `LastUsedTime` | `datetime` | Date and time when the app was last used|
55-
| `AppOwnerTenantId` | `string` |Specifies the ID of the tenant where the app was registeredrd|
57+
| `AppOwnerTenantId` | `string` |Specifies the ID of the tenant where the app was registered|
58+
59+
60+
The `OAuthAppInfo` table updates information on an hourly basis to record any changes in metadata or insights for OAuth apps based on data from Defender for Cloud Apps app governance.
61+
62+
Additionally, to ensure that `OAuthAppInfo` table retains data for the covered apps, a complete snapshot of all OAuth apps is sent twice a month (every 14th and 28th of the month).
5663

5764

5865

defender-xdr/advanced-hunting-schema-tables.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,7 @@ The following reference lists all the tables in the schema. Each table name link
100100
| **[IdentityInfo](advanced-hunting-identityinfo-table.md)** | Account information from various sources, including Microsoft Entra ID |
101101
| **[IdentityLogonEvents](advanced-hunting-identitylogonevents-table.md)** | Authentication events on Active Directory and Microsoft online services |
102102
| **[IdentityQueryEvents](advanced-hunting-identityqueryevents-table.md)** | Queries for Active Directory objects, such as users, groups, devices, and domains |
103+
| **[OAuthAppInfo](advanced-hunting-oauthappinfo-table.md)** (Preview) | Microsoft 365-connected OAuth applications registered with Microsoft Entra ID and available in the Defender for Cloud Apps app governance capability |
103104
| **[UrlClickEvents](advanced-hunting-urlclickevents-table.md)** | Safe Links clicks from email messages, Teams, and Office 365 apps |
104105

105106
## Related topics

defender-xdr/whats-new.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,10 @@ For more information on what's new with other Microsoft Defender security produc
3232

3333
You can also get product updates and important notifications through the [message center](https://admin.microsoft.com/Adminportal/Home#/MessageCenter).
3434

35+
36+
## April 2025
37+
- (Preview) The [OAuthAppInfo](advanced-hunting-oauthappinfo-table.md) table is now available for preview in advanced hunting. The table contains information about Microsoft 365-connected OAuth applications registered with Microsoft Entra ID and available in the Defender for Cloud Apps app governance capability.
38+
3539
## February 2025
3640

3741
- (Preview) IP addresses can now be excluded from automated responses in attack disruption. This feature allows you to exclude specific IPs from automated containment actions triggered by attack disruption. For more information, see [Exclude assets from automated responses in automatic attack disruption](automatic-attack-disruption-exclusions.md).

0 commit comments

Comments
 (0)