Updated NTLM Protocol Name for the Identity Advanced Hunting Tables

Originally posted by Microsoft Jan 31, 2023 Microsoft 365 suite 0 Comments

We are updating the NTLM protocol name for the Identity tables as part of the Microsoft 365 Advanced hunting feature for parity with other hunting tables.

When this will happen:

We will begin rolling out in late February and expect to complete rollout by early March.

How this will affect your organization:

The tables affected are: IdentityLogonEvents, IdentityQueryEvents, IdentityDirectoryEvents

The old protocol name Ntlm will now be the new protocol name NTLM.

What you need to do to prepare:

If you are currently using “Ntlm” protocol in case sensitive format from the identity event tables, you should change it from “NTLM”.

Message ID: MC509576