IdentityInfo
Note
Want to experience Microsoft 365 Defender? Learn more about how you can evaluate and pilot Microsoft 365 Defender.
Applies to:
- Microsoft 365 Defender
The IdentityInfo
table in the advanced hunting schema contains information about user accounts obtained from various services, including Azure Active Directory. Use this reference to construct queries that return information from this table.
Note
This table was renamed from AccountInfo
. During renames, all queries saved in the portal are automatically updated. Check queries you have saved elsewhere.
For information on other tables in the advanced hunting schema, see the advanced hunting reference.
Column name | Data type | Description |
---|---|---|
AccountObjectId |
string |
Unique identifier for the account in Azure AD |
AccountUpn |
string |
User principal name (UPN) of the account |
OnPremSid |
string |
On-premises security identifier (SID) of the account |
CloudSid |
string |
Cloud security identifier of the account |
GivenName |
string |
Given name or first name of the account user |
Surname |
string |
Surname, family name, or last name of the account user |
AccountDisplayName |
string |
Name of the account user displayed in the address book. Typically a combination of a given or first name, a middle initiation, and a last name or surname. |
Department |
string |
Name of the department that the account user belongs to |
JobTitle |
string |
Job title of the account user |
AccountName |
string |
User name of the account |
AccountDomain |
string |
Domain of the account |
EmailAddress |
string |
SMTP address of the account |
SipProxyAddress |
string |
Voice over IP (VOIP) session initiation protocol (SIP) address of the account |
City |
string |
City where the account user is located |
Country |
string |
Country/Region where the account user is located |
IsAccountEnabled |
boolean |
Indicates whether the account is enabled or not |
Related topics
Feedback
Submit and view feedback for