Microsoft Defender XDR services: New LDAP query events added to the IdentityQueryEvents table in Advanced Hunting
From Microsoft 365 Message Center Archive by Merill Fernando · Microsoft may not have sent this notice to your tenant.Rollout
Rollout dates are often only in the text. When Microsoft moves them, the change shows under "What changed".
What the notice says
Microsoft’s text, safely structuredNew LDAP query events will be added to the IdentityQueryEvents table in Advanced Hunting to provide more visibility into additional LDAP search queries running in the customer environment.
When this will happen
General Availability (Worldwide, GCC, GCC High, DoD): We will begin rolling out in early March 2025 and expect to complete by mid-March 2025.
How this will affect your organization
This update may lead to an increase in activity within the Advanced Hunting IdentityQueryEvents table for LDAP queries. If you have custom detections related to these queries, you may see a higher number of triggered alerts.
This update is available by default.
What you need to do to prepare
We recommend that you review your existing custom detections to ensure they align with your objectives. If needed, you can adjust your query accordingly.
More information: Create and manage custom detection rules in Microsoft Defender XDR
What changed
Between archive captures, newest firstOnly details this page does not show changed.
- · first version seen
Learn more
Links from the notice and their documentation checksRelated public changes
- Official documentation · 18 Oct 2026Defender for Identity on AD FS, AD CS and Entra Connect servers
Not confirmed here
What this page cannot tell you- Whether your tenant is affected: this is Microsoft's notice, not a check of your settings.
- 1 linked page has not been read yet.