Edit

IdentityInfo

  • Article

Note

Want to experience Microsoft 365 Defender? Learn more about how you can evaluate and pilot Microsoft 365 Defender.

Applies to:

  • Microsoft 365 Defender

The IdentityInfo table in the advanced hunting schema contains information about user accounts obtained from various services, including Azure Active Directory. Use this reference to construct queries that return information from this table.

Note

This table was renamed from AccountInfo. During renames, all queries saved in the portal are automatically updated. Check queries you have saved elsewhere.

For information on other tables in the advanced hunting schema, see the advanced hunting reference.

Column name Data type Description
AccountObjectId string Unique identifier for the account in Azure AD
AccountUpn string User principal name (UPN) of the account
OnPremSid string On-premises security identifier (SID) of the account
CloudSid string Cloud security identifier of the account
GivenName string Given name or first name of the account user
Surname string Surname, family name, or last name of the account user
AccountDisplayName string Name of the account user displayed in the address book. Typically a combination of a given or first name, a middle initiation, and a last name or surname.
Department string Name of the department that the account user belongs to
JobTitle string Job title of the account user
AccountName string User name of the account
AccountDomain string Domain of the account
EmailAddress string SMTP address of the account
SipProxyAddress string Voice over IP (VOIP) session initiation protocol (SIP) address of the account
City string City where the account user is located
Country string Country/Region where the account user is located
IsAccountEnabled boolean Indicates whether the account is enabled or not