IdentityLogonEvents table Roadmap

Microsoft

Is there a roadmap for this: consolidate all sign-in schema information into the IdentityLogonEvents table.

This is with respect to AADSignInEventsBeta & AADSpnSignInEventsBeta being offered on a short-term basis to allow you to hunt through Microsoft Entra sign-in events.

Bamidele_0-1725223102892.png

AADSpnSignInEventsBeta table in the advanced hunting schema - Microsoft Defender XDR | Microsoft Lea...

AADSignInEventsBeta table in the advanced hunting schema - Microsoft Defender XDR | Microsoft Learn

1 Reply
Same. While I do appreciate having the more granular data, non "Global" roles who have access to ADV hunting cannot view these Beta tables even though they do have access to the same data in the EntraID admin GUIs. It's been 3 years since their announcement:
https://techcommunity.microsoft.com/t5/microsoft-defender-xdr-blog/hunt-for-azure-active-directory-s...