Forum Discussion

david_n_o's avatar
david_n_o
Copper Contributor
Jan 20, 2026

Where can I get the latest info on Advanced Hunting Table Retirement

First question - where can I find the latest info on the deprecation of advanced hunting tables?

Background - I was developing some detections and as I was trying to decide on which table I should use I opened up the docs containing the schema for the `EntraIdSignInEvents` table (https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-entraidsigninevents-table) and was met by two ambiguous banners stating: 

"On December 9, 2025, the EntraIdSignInEvents table will replace AADSignInEventsBeta. This change will be made to remove the latter's preview status and to align it with the existing product branding. Both tables will coexist until AADSignInEventsBeta is deprecated after the said date.

To ensure a smooth transition, make sure that you update your queries that use the AADSignInEventsBeta table to use EntraIdSignInEvents before the previously mentioned date. Your custom detections will be updated automatically and won't require any changes."

"Some information relates to prereleased product that may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.

Customers need to have a Microsoft Entra ID P2 license to collect and view activities for this table."

 

This made me very confused as I still have data from AADSignInEventsBeta on my tenant from today. I'm not sure what this means and I'm hoping to get some clear info on table retirement. 

1 Reply

  • GoXATAKAN's avatar
    GoXATAKAN
    Brass Contributor

    AADSignInEventsBeta is not retired yet. It is still actively ingesting data, which is expected.

    EntraIdSignInEvents is the GA replacement for AADSignInEventsBeta. Both tables coexist until December 9, 2025, after which AADSignInEventsBeta will be deprecated. Until that date, seeing current data in AADSignInEventsBeta is normal.

    Microsoft-managed and custom scheduled detections will be updated automatically, but manual Advanced Hunting queries, workbooks, and API queries must be updated by customers to use EntraIdSignInEvents.

    Latest and authoritative updates on Advanced Hunting table deprecations can be tracked in:

    Microsoft Defender XDR : 

    Table schema pages (banner notices)

    Microsoft 365 Message Center announcements

    Recommendation: Use EntraIdSignInEvents for all new queries and migrate existing queries before December 9, 2025.

Resources