The EntraIdSpnSignInEvents table contains information about Microsoft Entra service

February 2026

(GA) The following advanced hunting schema tables are now generally available:

• The IdentityAccountInfo table contains information about account information from various sources, including Microsoft Entra ID. It also includes information and link to the identity that owns the account.
• The EntraIdSignInEvents table contains information about Microsoft Entra interactive and non-interactive sign-ins.
• The EntraIdSpnSignInEvents table contains information about Microsoft Entra service principal and managed identity sign-ins.
• The GraphApiAuditEvents table provides information about Microsoft Entra ID API requests made to Microsoft Graph API for resources in the tenant.