Update: Changing the Account Name Entity Mapping in Microsoft Sentinel

The upcoming update introduces more consistent and predictable entity data across analytics, incidents, and automation by standardizing how the Account Name property is populated when using UPN‑based mappings in analytic rules. Going forward, Account Name property will consistently contain only the UPN prefix, with new dedicated fields added for the full UPN and UPN suffix.

While this improves consistency and enables more granular automation, customers who rely on specific Account Name values in automation rules or Logic App playbooks may need to take action.

Timeline 

• Effective date: July 1, 2026.

• The change will apply automatically - no opt-in is required. 

Scope of impact 

Analytics Rules which include mapping of User Principal Name (UPN) to the Account Name entity field, where the resulting alerts are processed by Automation Rules or Logic App Playbooks that reference the AccountName property.

What’s changing 

Currently

When an Analytic Rule includes mapping of a full UPN (for example: 'user@domain.com') to the Account Name field, the resulting input value for the Automation Rule or/and Logic App Playbook is inconsistent. In some cases, it contains only the UPN prefix: 'user', and in other cases the full UPN ('user@domain.com').

After July 1, 2026 

• • Account Name property will consistently contain only the UPN prefix 

• • The following new fields will be added to the entity object:  

• • • AccountName (UPN prefix)

• • • UPNSuffix

• • • UserPrincipalName (full UPN)

This change provides an enhanced filtering and automation logic based on these new fields.

Example 

Before 

• • Analytics Rule maps: 'user@domain.com' 

• • Automation Rule receives:  

• • • Account Name: 'user' or 'user@domain.com' (inconsistent) 

After 

• • Analytics Rule maps: 'user@domain.com'

• • Automation Rule receives:  

• • • Account Name: 'user' 

• • • UPNSuffix: 'domain.com'
•  
  • Logic App Playbook and SecurityAlert table receives:

• • • AccountName: 'user' 
  •  
    • UPNSuffix: 'domain.com'
  •  
    • UserPrincipalName: 'user@domain.com' 

 

Why does it matter? 

If your automation logic relies on exact string comparisons against the full UPN stored in Account Name, those conditions may no longer match after the update. 

This most commonly affects: 

• • Automation Rules using "Equals" condition on Account Name 
  • Logic App Playbooks comparing entity field 'accountName' to a full UPN value 

Call to action

1. Avoid strict equality checks against Account Name
2. Use flexible operators such as: 
   • Contains 
   • Starts with 
3. Leverage the new UPNSuffix field for clearer intent 

Example update 

• Before - Account name will show as 'user' or 'user@domain.com'
• After - Account Name will show as 'user'  
• Recommended changes:
  • Account Name Contains/Startswith 'user'  
  • UPNSuffix Equals/Startswith/Contains 'domain.com' 

This approach ensures compatibility both before and after the change takes effect. 

Where to update 

Review any filters, conditions, or branching logic that depend on Account Name values. 

• Automation Rules: Use the 'Account name' field 

• Logic App Playbooks: Update conditions referencing the entity: 'accountName' 

 

For example:  

• • Automation Rule before the change: 

 

 

• • Automation Rule after the change: 

 

Summary 

• A consistency improvement to Account Name mapping is coming on July 1, 2026 

• The change affects Automation Rules and Logic App Playbooks that rely on UPN to Account Name mappings 

• New UPN related fields provide better structure and control 

• Customers should follow the recommendations above before the effective change date