You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-xdr/advanced-hunting-oauthappinfo-table.md
+16-9Lines changed: 16 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
---
2
2
title: OAuthAppInfo table in the advanced hunting schema
3
-
description: Learn about the
3
+
description: Learn about the OAuthAppInfo table which contains information about Microsoft 365-connected OAuth applications registered with Microsoft Entra ID and available in the Defender for Cloud Apps app governance capability.
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
33
32
34
-
The `DeviceBaselineComplianceAssessment` table in the advanced hunting schema contains baseline compliance assessment snapshot, which indicates the status of various security configurations related to baseline profiles on devices.
33
+
The `OAuthAppInfo` table in the advanced hunting schema contains information about Microsoft 365-connected OAuth applications in the organization that are registered with Microsoft Entra ID and available in the Microsoft Defender for Cloud Apps app governance capability.
34
+
35
+
The `OAuthAppInfo` table might not include all the app or service principal-related properties that are available on Entra ID. It also does not include data related to Microsoft first-party apps or apps without any OAuth consents. The coverage of the table is based on the existing scope of Microsoft 365-connected apps covered by app governance.
36
+
35
37
36
38
For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-schema-tables.md).
37
39
@@ -50,9 +52,14 @@ For information on other tables in the advanced hunting schema, see [the advance
50
52
|`Permissions`|`dynamic`| Contains an array of permission objects; each permission object includes PermissionName, TargetAppId, TargetAppDisplayName, PermissionType, PrivilegeLevel, UsageStatus|
51
53
|`ConsentedUsersCount`|`integer`| Count of users who have consented to the app; this information is only available when the app is not admin consented|
52
54
|`IsAdminConsented`|`boolean`| Value is True if a user has provided admin consent to the app on behalf of all the users in the org, otherwise the value is False|
53
-
|`AppOrigin`|`string`| Specifies whether was the app is internal to the organization or registered in an external tenant|
55
+
|`AppOrigin`|`string`| Specifies whether the app is internal to the organization or registered in an external tenant|
54
56
|`LastUsedTime`|`datetime`| Date and time when the app was last used|
55
-
|`AppOwnerTenantId`|`string`|Specifies the ID of the tenant where the app was registeredrd|
57
+
|`AppOwnerTenantId`|`string`|Specifies the ID of the tenant where the app was registered|
58
+
59
+
60
+
The `OAuthAppInfo` table updates information on an hourly basis to record any changes in metadata or insights for OAuth apps based on data from Defender for Cloud Apps app governance.
61
+
62
+
Additionally, to ensure that `OAuthAppInfo` table retains data for the covered apps, a complete snapshot of all OAuth apps is sent twice a month (every 14th and 28th of the month).
Copy file name to clipboardExpand all lines: defender-xdr/advanced-hunting-schema-tables.md
+1Lines changed: 1 addition & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -100,6 +100,7 @@ The following reference lists all the tables in the schema. Each table name link
100
100
|**[IdentityInfo](advanced-hunting-identityinfo-table.md)**| Account information from various sources, including Microsoft Entra ID |
101
101
|**[IdentityLogonEvents](advanced-hunting-identitylogonevents-table.md)**| Authentication events on Active Directory and Microsoft online services |
102
102
|**[IdentityQueryEvents](advanced-hunting-identityqueryevents-table.md)**| Queries for Active Directory objects, such as users, groups, devices, and domains |
103
+
|**[OAuthAppInfo](advanced-hunting-oauthappinfo-table.md)** (Preview) | Microsoft 365-connected OAuth applications registered with Microsoft Entra ID and available in the Defender for Cloud Apps app governance capability |
103
104
|**[UrlClickEvents](advanced-hunting-urlclickevents-table.md)**| Safe Links clicks from email messages, Teams, and Office 365 apps |
Copy file name to clipboardExpand all lines: defender-xdr/whats-new.md
+4Lines changed: 4 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -32,6 +32,10 @@ For more information on what's new with other Microsoft Defender security produc
32
32
33
33
You can also get product updates and important notifications through the [message center](https://admin.microsoft.com/Adminportal/Home#/MessageCenter).
34
34
35
+
36
+
## April 2025
37
+
- (Preview) The [OAuthAppInfo](advanced-hunting-oauthappinfo-table.md) table is now available for preview in advanced hunting. The table contains information about Microsoft 365-connected OAuth applications registered with Microsoft Entra ID and available in the Defender for Cloud Apps app governance capability.
38
+
35
39
## February 2025
36
40
37
41
- (Preview) IP addresses can now be excluded from automated responses in attack disruption. This feature allows you to exclude specific IPs from automated containment actions triggered by attack disruption. For more information, see [Exclude assets from automated responses in automatic attack disruption](automatic-attack-disruption-exclusions.md).
0 commit comments