Summary
- Microsoft Defender XDR is retiring the legacy Advanced Hunting tables AADSignInEventsBeta and AADSpnSignInEventsBeta.
- These tables are being replaced by the GA EntraIdSignInEvents and EntraIdSpnSignInEvents tables, with a schema rename for AadDeviceId to EntraIdDeviceId in the new AADSignInEventsBeta replacement.
- Security admins, threat hunters, SOC teams, detection engineers, and admins who maintain queries, detections, workbooks, scripts, APIs, or integrations are affected.
- Microsoft will automatically migrate custom detections that reference the retiring tables, but external content outside that managed path may fail if it still uses the old names.
- Review and update all hunting content to use the new table and column names before the retirement cutoff.
Primary Service: Defender XDR
Admin Impact: High
User Impact: Low
Release Start: 01 Oct 2026
Release End: 31 Jan 2027
Services: Defender XDR, Entra
Category: Plan for change
Tags: Admin Action, Retirement, User Adoption
History
11/5/2026 Item Added to Message Center
Microsoft Message
On January 31, 2027, Microsoft Defender XDR will retire the AADSignInEventsBeta and AADSpnSignInEventsBeta tables in Advanced Hunting. These tables are replaced by the generally available EntraIdSignInEvents and EntraIdSpnSignInEvents tables. The replacement names align with Microsoft Entra ID branding and remove the Beta designation.
Rollout schedule
- General Availability of the new tables (Worldwide, GCC, GCC High, and DoD): October 2026
- Deprecation of old tables (Worldwide, GCC, GCC High, and DoD): January 31st, 2027
Impact on your organization
Who is affected
Security administrators, threat hunters, detection engineers, SOC teams, and administrators who maintain queries, custom detections, workbooks, scripts, APIs, or integrations that reference the retiring table or column names
Platforms and services
Microsoft Defender XDR Advanced Hunting
What will happen
- AADSignInEventsBeta will be replaced by EntraIdSignInEvents.
- AADSpnSignInEventsBeta will be replaced by EntraIdSpnSignInEvents.
- In AADSignInEventsBeta table, the AadDeviceId column name is replaced by EntraIdDeviceId in the new schemas.
- Microsoft Defender will automatically migrate custom detections that reference the retiring tables.
- External scripts, workbooks, APIs, integrations, and other content outside the managed migration path might fail if they continue to reference the retiring names.
Action required
Action is required before January 31, 2027.
Review and update any content that references the retiring table or column names.
Recommended actions:
- Inventory custom detections, saved queries, hunting queries, workbooks, scripts, APIs, SIEM content, and integrations that reference AADSignInEventsBeta or AADSpnSignInEventsBeta.
- Update any content to use EntraIdSignInEvents and EntraIdSpnSignInEvents.
- Replace references to AadDeviceId with EntraIdDeviceId, where applicable.
- Review the replacement schemas for any column, data type, or casing differences.
- Complete migrating any content referencing the old tables, to use the new tables before January 31, 2027.
Learn more
- EntraIdSignInEvents | Microsoft Defender XDR | Microsoft Defender | Microsoft Learn
- EntraIdSpnSignInEvents | Microsoft Defender XDR | Microsoft Defender | Microsoft Learn
Compliance considerations
No compliance considerations identified. Review as appropriate for your organization.