Microsoft Defender XDR
Hunting and detectionAADSpnSignInEventsBeta table in the advanced hunting schema (deprecated)
In brief
The table is now documented as deprecated and will be replaced by EntraIdSpnSignInEvents on October 19, 2026. Queries using it will be migrated automatically.
What Defender admins need to know
Administrators should be aware of the upcoming table replacement; no action is stated as required.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
AADSpnSignInEventsBeta (deprecated)
@@ -1,5 +1,5 @@ ----title: AADSpnSignInEventsBeta table in the advanced hunting schema+title: AADSpnSignInEventsBeta table in the advanced hunting schema (deprecated) description: Learn about information associated with the Beta Microsoft Entra service principal and managed identity sign-in events table. ms.service: defender-xdr ms.subservice: adv-hunting@@ -12,19 +12,21 @@ ms.collection: ms.custom: - cx-ti - cx-ah+- msecd-doc-authoring-1018 appliesto: - Microsoft Defender XDR - Microsoft Sentinel in the Microsoft Defender portal ms.topic: reference-ms.date: 11/04/2025+ms.date: 07/27/2026+ai-usage: ai-assisted --- -# AADSpnSignInEventsBeta+# AADSpnSignInEventsBeta (deprecated) > [!IMPORTANT]-> On December 9, 2025, the `AADSpnSignInEventsBeta` table will be replaced by [`EntraIdSpnSignInEvents`](advanced-hunting-entraidspnsigninevents-table.md). This change will be made to remove the former's preview status and to align it with the existing product branding.+> On October 19, 2026, the `AADSpnSignInEventsBeta` table will be deprecated and replaced by [`EntraIdSpnSignInEvents`](advanced-hunting-entraidspnsigninevents-table.md). This change removes the former's preview status and aligns it with the existing product branding. >-> The `EntraIdSpnSignInEvents` table is already available. To ensure a smooth transition, make sure that you update your queries that use the `AADSpnSignInEventsBeta` table to use `EntraIdSpnSignInEvents` before the previously mentioned date. +> The `EntraIdSpnSignInEvents` table is already available. All queries that use `AADSpnSignInEventsBeta` will be migrated automatically to `EntraIdSpnSignInEvents` on October 19, 2026. > [!IMPORTANT] > The `AADSpnSignInEventsBeta` table is currently in beta and is being offered on a short-term basis to allow you to hunt through Microsoft Entra sign-in events. Customers need to have a Microsoft Entra ID P2 license to collect and view activities for this table.