Microsoft Entra Suite Tech Accelerator
Aug 14 2024, 07:00 AM - 09:30 AM (PDT)
Microsoft Tech Community

Defender for Identity - Streaming of events possible?

Brass Contributor


In Defender for Endpoint events can be forwarded through Azure Event hubs or Azure storage (see link). How do I archieve the same functionality through Defender for Identity?


Particular I am interesting in the following tables:

  • IdentityQueryEvents (DC DNS events)
  • IdentityDirectoryEvents (DC events)


I could not find such data-export functionality in the Azure-ATP portal.

Additionally I've enabled telemetry data-sharing between Defender for Endpoint and Defender for Identity, so I can access the schema tables from Microsoft 365 security (central portal) but still even I cannot use the internal Defender-ATP data-exporter to enable/click forwarding for these data tables.

The current CEF exporter for Defender for Identity (see link) in CEF-format only gives alerts and some additional test-messages. Couldn't find the raw events here too.


So how do I forward all Defender for Identity raw data to an Azure Hub/Azure storage so e.g. Advanced Hunting of that data is possible in third party SIEM?


Related MS-Blog for hunting in Azure-ATP data via KQL:



Regards from Germany



3 Replies


Hi Bill,

All Defender for Identity activities are available in the M365D advanced hunting feature

And will be made available to stream via its API capabilities

*Note, the APIs are currently being evaluated so some functionality might be missing


You can also export Defender for Identity via MCAS SIEM connector

@Or Tsemah- Thanks for your answer! MCAS connector for Defender for Identity does not print all raw events. But the other API you mentioned... Streaming API for Advanced Hunting. Thats the solution to get access to it (or kinda every raw data if needed). Did not really think of it that way :) Thank you for your reply!

best response confirmed by BillTheKid (Brass Contributor)
1 best response

Accepted Solutions
best response confirmed by BillTheKid (Brass Contributor)