Important
The improved Microsoft 365 Defender portal is now available. This new experience brings Defender for Endpoint, Defender for Office 365, Microsoft 365 Defender, and more into the Microsoft 365 Defender portal. Learn what’s new.
Applies to:
- Microsoft 365 Defender
The IdentityInfo
table in the advanced hunting schema contains information about user accounts obtained from various services, including Azure Active Directory. Use this reference to construct queries that return information from this table.
Note
This table was renamed from AccountInfo
. During renames, all queries saved in the portal are automatically updated. Check queries you have saved elsewhere.
For information on other tables in the advanced hunting schema, see the advanced hunting reference.
Column name | Data type | Description |
---|---|---|
AccountObjectId |
string |
Unique identifier for the account in Azure AD |
AccountUpn |
string |
User principal name (UPN) of the account |
OnPremSid |
string |
On-premises security identifier (SID) of the account |
CloudSid |
string |
Cloud security identifier of the account |
GivenName |
string |
Given name or first name of the account user |
Surname |
string |
Surname, family name, or last name of the account user |
AccountDisplayName |
string |
Name of the account user displayed in the address book. Typically a combination of a given or first name, a middle initiation, and a last name or surname. |
Department |
string |
Name of the department that the account user belongs to |
JobTitle |
string |
Job title of the account user |
AccountName |
string |
User name of the account |
AccountDomain |
string |
Domain of the account |
EmailAddress |
string |
SMTP address of the account |
SipProxyAddress |
string |
Voice over IP (VOIP) session initiation protocol (SIP) address of the account |
City |
string |
City where the account user is located |
Country |
string |
Country/Region where the account user is located |
IsAccountEnabled |
boolean |
Indicates whether the account is enabled or not |