Defender-IdentityAccountInfo

ActionTypeTitleSampleRule
anyIdentity account informationYN

any: Identity account information

#
Table
IdentityAccountInfo

Fields #

NameDescription
Timestamp
ReportId
AccountId
IdentityId
IdentityLinkType
DisplayName
AccountUpn
EmailAddress
CriticalityLevel
GivenName
Surname
Department
JobTitle
Sid
AccountStatus
SourceProvider
SourceProviderInstanceDisplayName
AuthenticationMethod
LastPasswordChangeTime
GroupMembership
AssignedRoles
CreatedDateTime
Tags
AdditionalFields
MachineGroup

Example Event #

{
  "AccountId": "AadAccount_00000000-0000-0000-0000-000000000001_11111111-1111-1111-1111-111111111111",
  "AccountStatus": "Enabled",
  "AccountUpn": "adminuser@example.onmicrosoft.com",
  "AssignedRoles": [
    "Global Administrator"
  ],
  "AssignedRoles@odata.type": "#Collection(String)",
  "CreatedDateTime": "2026-01-17T02:18:03Z",
  "DisplayName": "Admin User",
  "EmailAddress": "adminuser@example.onmicrosoft.com",
  "GivenName": "Admin",
  "GroupMembership@odata.type": "#Collection(String)",
  "IdentityId": "User_00000000-0000-0000-0000-000000000001_678ad294-74ae-4dbd-b59a-8e861a00b5e0",
  "IdentityLinkType": "StrongId",
  "IsPrimary": 1,
  "IsPrimary@odata.type": "#SByte",
  "Phone": "4085680442",
  "ReportId": "ee340bf8-2188-453f-acc9-9e8d7d94aa36",
  "Sid": "S-1-12-1-2203833961-1078582856-4269134526-4172038298",
  "SourceProvider": "AzureActiveDirectory",
  "SourceProviderAccountId": "11111111-1111-1111-1111-111111111111",
  "Surname": "User",
  "Tags@odata.type": "#Collection(String)",
  "Timestamp": "2026-08-01T16:32:12.9218713Z",
  "Type": "User"
}

References #