Microsoft 365 Alert – Service Degradation – Microsoft Defender XDR – A subset of data in CloudAppEvents and IdentityLogonEvents Advanced Hunting tables was unavailable – RESOLVED

Announcements Arpan Das

07/05/2026 08:55:00 AM

NHSmail Reference: INC46818287

Microsoft Reference: DZ1302360

Issue Status: RESOLVED

Issue Description: A subset of data in CloudAppEvents and IdentityLogonEvents Advanced Hunting tables was unavailable.

More info: As a result, some Advanced Hunting queries may have returned incomplete results, depending on the query and data sources used. Most queries and scenarios continued to work as expected. Some detections, including custom detection rules that rely on the affected data, may not have triggered during the impact window. In some cases, alerts may have been created with partial information. Other detections, including near‑real‑time protections and enforcement actions, continued to operate normally.

Final Update: 07/05/2026 08:55:00 AM– Microsoft has determined that a recent infrastructure migration resulted in a component not being included as part of the transition, which led to impact. They have implemented a fix to restore the component, and confirmed that impact has been fully remediated.

Scope of impact: Your organization was affected by this event, and some admins and users attempting to utilize a subset of data in CloudAppEvents and IdentityLogonEvents Advanced Hunting tables were impacted.

Root cause: A recent infrastructure migration resulted in a component not being included as part of the transition, which led to impact.

Next Steps: Microsoft are reviewing their migration procedures to better identify similar issues during their development and testing cycles.