Microsoft Defender for Identity: “Honeytoken was queried via SAM-R alert” retires June 30, 2024

Originally posted by Microsoft May 31, 2024 Uncategorized 0 Comments

The “Honeytoken was queried via SAM-R” feature in Microsoft Defender for Identity will retire on June 30, 2024. Users should use advanced hunting queries for custom detection. After retirement, alerts for honeytoken queries using SAM-R protocol will stop. Users need to prepare by adapting to the recommended query method.

We will be retiring the feature Honeytoken was queried via SAM-R from Microsoft Defender for Identity on June 30, 2024. Instead, we recommend using hunting activities to generate custom detection when required.

How this will affect your organization:

You are receiving this message because our reporting indicates one or more users in your organization are using Microsoft Defender for Identity.

After this feature retires, honeytoken users will no longer receive alerts when honeytoken is queried using SAM-R protocol.

What you need to do to prepare:

Instead of using Honeytoken was queried via SAM-R alert, we recommend using this advanced hunting query to generate custom detection based on your environment configuration:

let users = pack_array("User1_SID", "User2_SID");

IdentityQueryEvents

| where ActionType =='SAMR query'

| extend TargetSid = AdditionalFields.'TargetAccountSid'

| extend tostring(TargetSid)

| where isnotempty(TargetSid) and isnotempty(AccountUpn)

| where TargetSid in (users)

Learn more:

• Entity tags in Microsoft Defender for Identity – Microsoft Defender for Identity | Microsoft Learn
• Create and manage custom detection rules in Microsoft Defender XDR – Microsoft Defender XDR | Microsoft Learn

Message ID: MC797115