What's Changing
Microsoft has announced a schema update for Advanced Hunting sign-in data in Defender XDR. The two "Beta" tables that never lost their beta suffix are finally being renamed to match the Entra ID branding:
| Legacy table (deprecated Oct 19, 2026) | New table (available now) |
|---|---|
AADSignInEventsBeta |
EntraIdSignInEvents |
AADSpnSignInEventsBeta |
EntraIdSpnSignInEvents |
Both old and new tables coexist until October 19, 2026, when the legacy tables are deprecated. The rename also removes the preview status — these tables have powered production detections for years while technically being "beta", so this is overdue housekeeping as much as it is a rebrand.
What Updates Automatically
The good news: anything living inside the Defender portal gets migrated for you.
- Saved queries in Advanced Hunting
- Custom detection rules in Defender XDR
If you followed our advice in the analytics rule limit workaround and moved identity detections into XDR custom detections, those rules will be updated automatically. One less thing to worry about.
What You Have to Fix Yourself
Anything that lives outside the portal is your problem:
- Detection-as-code repositories - if your custom detections are deployed from a Git repo, the portal copy gets renamed but your source of truth doesn't. Your next pipeline run could redeploy the old table name.
- Scripts and API integrations - anything calling the Advanced Hunting API with a hardcoded query
- Notebooks, runbooks, and documentation - hunting playbooks your analysts copy-paste from
- Community queries - that KQL you borrowed from a blog post in 2023 still says
AADSignInEventsBeta
Finding them is the easy part. For repos, a simple grep does it:
grep -rn "AADSignInEventsBeta\|AADSpnSignInEventsBeta" .What About Sentinel?
If your sign-in detections are built on the SigninLogs and AADServicePrincipalSignInLogs tables from the Entra ID diagnostic settings connector, this change doesn't touch them. This rename only affects the XDR Advanced Hunting tables. Workspaces onboarded to the unified portal that query the XDR tables from Sentinel-side content should still be checked.
Validate Now, Not in October
The new tables are already live, so you can test the rename before committing to it. A quick sanity check that both tables return the same data:
// Compare row counts over the last day
union
(AADSignInEventsBeta | where Timestamp > ago(1d) | summarize LegacyCount = count()),
(EntraIdSignInEvents | where Timestamp > ago(1d) | summarize NewCount = count())Then update your external queries table by table, run them side by side for a few days, and retire the legacy names on your own schedule — not Microsoft's.
The Practical Checklist
- Grep your repos for both legacy table names
- Inventory API callers - Logic Apps, scheduled scripts, third-party tools that run hunting queries
- Swap the table names - the schema is the same, so it really is a rename
- Validate side by side while both tables exist
- Spot-check portal content after the auto-migration - trust, but verify
Contributions welcome. If you've got additional insights or corrections, feel free to reach out on LinkedIn or GitHub.