Microsoft Defender XDR

CallActivityEvents table in the advanced hunting schema

4 September 2026New feature+60 / −0 lines

In brief

The new table documents Microsoft Teams call activity details, including timestamps, call and participant identifiers, activity types, scheduling information, and join links. It is populated by Microsoft Defender for Office 365.

What Defender admins need to know

Admins can use the table when building advanced hunting queries. Queries return no results unless Defender for Office 365 is deployed in Defender.

Summaries are generated from the documentation change itself.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

new file mode 100644

title: CallActivityEvents table in the advanced hunting schema titleSuffix: Microsoft Defender description: Learn about the CallActivityEvents table in the advanced hunting schema, which contains details about activities performed during Microsoft Teams calls. ms.service: defender-xdr ms.subservice: adv-hunting ms.author: pauloliveria author: poliveria ms.localizationpriority: medium ms.collection:

m365-security
tier3 ms.custom:
cx-ti
cx-ah appliesto:
- Microsoft Defender XDR ms.topic: reference ms.date: 08/04/2026 ai-usage: ai-assisted

CallActivityEvents

[!INCLUDE Microsoft Defender XDR rebranding]

The CallActivityEvents table in the advanced hunting schema contains details about activities performed during Microsoft Teams calls in your organization.

This advanced hunting table is populated by records from Microsoft Defender for Office 365. If your organization hasn't deployed the service in Microsoft Defender, queries that use the table don't work or return any results. For more information about how to deploy Defender for Office 365 in the Defender portal, read Deploy supported services.

Schema

For information on other tables in the advanced hunting schema, see the advanced hunting reference.

Column name	Data type	Description
`ActivityTimestamp`	`datetime`	Date and time when the activity was recorded
`CallId`	`string`	Unique identifier for the call, as generated by Microsoft 365
`ActivityId`	`string`	Unique identifier for the activity, as generated by Microsoft 365
`ActivityInitiatorId`	`string`	Unique identifier for the participant who initiated the activity
`ActivityType`	`string`	Type of activity performed during the call
`ThreadId`	`string`	Unique identifier for the thread associated with the call
`ActivityInitiatorUpn`	`string`	User principal name of the participant who initiated the activity
`ActivityInitiatorDisplayName`	`string`	Display name of the participant who initiated the activity
`CallSchedulingType`	`string`	Type of scheduling for the call, such as `Adhoc`, `Scheduled`, or `Recurring`
`CallJoinUrl`	`string`	Link that participants use to join the call
`OriginatorUserDisplayName`	`string`	Display name of the caller who initiated the call
`OriginatorUpn`	`string`	User principal name of the caller who initiated the call

@@ -0,0 +1,60 @@+---+title: CallActivityEvents table in the advanced hunting schema+titleSuffix: Microsoft Defender+description: Learn about the CallActivityEvents table in the advanced hunting schema, which contains details about activities performed during Microsoft Teams calls.+ms.service: defender-xdr+ms.subservice: adv-hunting+ms.author: pauloliveria+author: poliveria+ms.localizationpriority: medium+ms.collection:+- m365-security+- tier3+ms.custom:+- cx-ti+- cx-ah+appliesto:+    - Microsoft Defender XDR+ms.topic: reference+ms.date: 08/04/2026+ai-usage: ai-assisted+---++# CallActivityEvents++[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]++The `CallActivityEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains details about activities performed during Microsoft Teams calls in your organization.++This advanced hunting table is populated by records from Microsoft Defender for Office 365. If your organization hasn't deployed the service in Microsoft Defender, queries that use the table don't work or return any results. For more information about how to deploy Defender for Office 365 in the Defender portal, read [Deploy supported services](deploy-supported-services.md).++> [!NOTE]+> Support for the event streaming API, Microsoft Sentinel integration, and more attributes is planned for the coming weeks.++## Schema++For information on other tables in the advanced hunting schema, [see the advanced hunting reference](advanced-hunting-schema-tables.md).++| Column name | Data type | Description |+|-------------|-----------|-------------|+| `ActivityTimestamp` | `datetime` | Date and time when the activity was recorded |+| `CallId` | `string` | Unique identifier for the call, as generated by Microsoft 365 |+| `ActivityId` | `string` | Unique identifier for the activity, as generated by Microsoft 365 |+| `ActivityInitiatorId` | `string` | Unique identifier for the participant who initiated the activity |+| `ActivityType` | `string` | Type of activity performed during the call |+| `ThreadId` | `string` | Unique identifier for the thread associated with the call |+| `ActivityInitiatorUpn` | `string` | User principal name of the participant who initiated the activity |+| `ActivityInitiatorDisplayName` | `string` | Display name of the participant who initiated the activity |+| `CallSchedulingType` | `string` | Type of scheduling for the call, such as `Adhoc`, `Scheduled`, or `Recurring` |+| `CallJoinUrl` | `string` | Link that participants use to join the call |+| `OriginatorUserDisplayName` | `string` | Display name of the caller who initiated the call |+| `OriginatorUpn` | `string` | User principal name of the caller who initiated the call |++## Related topics++- [Advanced hunting overview](advanced-hunting-overview.md)+- [Learn the query language](advanced-hunting-query-language.md)+- [Understand the schema](advanced-hunting-schema-tables.md)+- [Apply query best practices](advanced-hunting-best-practices.md)++[!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)]