Forum Discussion
DFI/DFE and IdentityQueryEvents DNS events
Should I expect to see any DNS query events from DFE endpoints in the IdentityQueryEvents schema table if I have DFI enabled? This doc - https://learn.microsoft.com/en-us/microsoft-365/security/d...
SpeedRacer theoretically yes, but there might be edge-cases where some DNS requests won't be visible on MDI but rather on MDE, depending on what DNS server is used.
For MDE use ActionType: DnsQueryRequest
For MDI use ActionType: DNS query
I would suggest putting up usecases on both datasources.
- TYVM for the reply and info
