MC1183015 | Fix/Update Microsoft Sentinel Account Entity Naming to avoid inconsistent account identification in incidents and alerts

Service

Microsoft Defender XDR

Last Updated

2025-11-19T19:18:28.307Z

Published

2025-11-05T00:24:20Z

Message ID

MC1183015

Updated November 19, 2025: We have updated the timing of this change below. Thank you for your patience. On July 1, 2026, you may encounter issues if you haven't updated your analytic rules, automation rules/playbooks, workbooks, hunting queries, or custom integrations to be precedence-aware for account entity naming. We've standardized the account entity naming logic in Microsoft Sentinel incidents and alerts, where the account entity naming priority is: UPN prefix → name → display name. Please update your queries and automations to use the new precedence pattern. You are receiving this message because our reporting indicates your organization may be using Microsoft Sentinel incidents, aler...

Open Full Notification Browse Message Center

This page is an SEO landing page for discoverability of Message Center ID MC1183015.