Microsoft Defender XDR: Retirement of AADSignInEventsBeta and AADSpnSignInEventsBeta tables

[What and why]

On January 31, 2027, Microsoft Defender XDR will retire the AADSignInEventsBeta and AADSpnSignInEventsBeta tables in Advanced Hunting. These tables are replaced by the generally available EntraIdSignInEvents and EntraIdSpnSignInEvents tables. The replacement names align with Microsoft Entra ID branding and remove the Beta designation.

[Rollout schedule]

General Availability of the new tables (Worldwide, GCC, GCC High, and DoD): October 2026

Deprecation of old tables (Worldwide, GCC, GCC High, and DoD): January 31st, 2027

[Impact on your organization]

Who is affected

• Security administrators, threat hunters, detection engineers, SOC teams, and administrators who maintain queries, custom detections, workbooks, scripts, APIs, or integrations that reference the retiring table or column names

Platforms and services

• Microsoft Defender XDR Advanced Hunting

What will happen

• AADSignInEventsBeta will be replaced by EntraIdSignInEvents.
• AADSpnSignInEventsBeta will be replaced by EntraIdSpnSignInEvents.
• In AADSignInEventsBeta table, the AadDeviceId column name is replaced by EntraIdDeviceId in the new schemas.
• Microsoft Defender will automatically migrate custom detections that reference the retiring tables.
• External scripts, workbooks, APIs, integrations, and other content outside the managed migration path might fail if they continue to reference the retiring names.

[Action required]

Action is required before January 31, 2027.

Review and update any content that references the retiring table or column names.

Recommended actions:

• Inventory custom detections, saved queries, hunting queries, workbooks, scripts, APIs, SIEM content, and integrations that reference AADSignInEventsBeta or AADSpnSignInEventsBeta.
• Update any content to use EntraIdSignInEvents and EntraIdSpnSignInEvents.
• Replace references to AadDeviceId with EntraIdDeviceId, where applicable.
• Review the replacement schemas for any column, data type, or casing differences.
• Complete migrating any content referencing the old tables, to use the new tables before January 31, 2027.

Learn more

• EntraIdSignInEvents | Microsoft Defender XDR | Microsoft Defender | Microsoft Learn
• EntraIdSpnSignInEvents | Microsoft Defender XDR | Microsoft Defender | Microsoft Learn

[Compliance considerations]

No compliance considerations identified. Review as appropriate for your organization.