Microsoft Defender XDR

Investigate Users

21 October 2026Doc update+3 / −3 lines

In brief

The user investigation documentation revises its authoring reference links and changes `GraphApiAuditEvents` to `GraphAPIAuditEvents`.

What Defender admins need to know

No administrator action is required.

Summaries are generated from the documentation change itself.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

CloudAppEvents
DeviceLogonEvents
EntraIdSignInEvents
~~GraphApiAuditEvents~~GraphAPIAuditEvents

Timeline schema

@@ -34,12 +34,12 @@ item_type: Content source_path: defender-xdr/investigate-users.md cmProducts: - https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/1433a524-c01f-4b87-beab-670c040dea4f+- https://authoring-docs-microsoft.poolparty.biz/devrel/fcc3cd4a-59ea-47a2-9cc1-784142a5a25d - https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/c671beaa-a830-4c9f-aceb-97379ee031ca-- https://authoring-docs-microsoft.poolparty.biz/devrel/b1cfdec6-b0c3-4209-818c-736879856e0e spProducts: - https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/312f1f05-a431-4193-8a4d-e6245d5966de+- https://authoring-docs-microsoft.poolparty.biz/devrel/d7a55faf-a992-4e27-aa3a-eadc9830e778 - https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/8921374c-4dbe-4ed0-b011-a39e18bfbd98-- https://authoring-docs-microsoft.poolparty.biz/devrel/2d0723c1-cf38-4c30-ab3d-5df787b33270 platformId: 4336783c-e0f3-cd37-4d0c-a66de5146f58 --- @@ -183,7 +183,7 @@ The timeline draws from multiple advanced hunting tables and normalizes them int - CloudAppEvents
 - DeviceLogonEvents
 - EntraIdSignInEvents
-- GraphApiAuditEvents
+- GraphAPIAuditEvents
 
 ### Timeline schema