Microsoft Defender XDR
Hunting and detectionAdvanced Hunting Schema Changes
In brief
The `AadDeviceId` column is being replaced by `EntraIdDeviceId`. `AadDeviceId` will remain available for 30 days to support query updates.
What Defender admins need to know
Update hunting queries that reference `AadDeviceId` to use `EntraIdDeviceId` within the 30-day transition period.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
September 2025
In the AADSignInEventsBetaAADSignInEventsBeta table, the AadDeviceId column is being replaced with a new column, called EntraIdDeviceId, to align with current product branding. The legacy AadDeviceId column will remain in the schema for 30 days to allow time for updating in your queries. After this period of 30 days, AadDeviceId will be removed from the schema.
May 2025
@@ -84,7 +84,7 @@ Naming changes are automatically applied to queries that are saved in Microsoft
## September 2025
-In the [AADSignInEventsBeta](advanced-hunting-aadspnsignineventsbeta-table) table, the `AadDeviceId` column is being replaced with a new column, called `EntraIdDeviceId`, to align with current product branding. The legacy `AadDeviceId` column will remain in the schema for 30 days to allow time for updating in your queries. After this period of 30 days, `AadDeviceId` will be removed from the schema.
+In the [AADSignInEventsBeta](advanced-hunting-aadsignineventsbeta-table) table, the `AadDeviceId` column is being replaced with a new column, called `EntraIdDeviceId`, to align with current product branding. The legacy `AadDeviceId` column will remain in the schema for 30 days to allow time for updating in your queries. After this period of 30 days, `AadDeviceId` will be removed from the schema.
## May 2025