Exploring IdentityAccountInfo - Building a KQL Query to Assess Identity Password Security Posture

Sat, 06 Dec 2025 12:27:02 +0000

Recently Microsoft Defender XDR introduced a new table called IdentityAccountInfo, and this one immediately caught my attention. It brings several interesting attributes into Advanced Hunting, including LastPasswordChangeTime and even the sensitivity classification of an identity.

Naturally, my first thought was: this is perfect material for some hunting logic, so let’s build a KQL query out of it.

Why am I excited about this? Because it finally allows us to query identity hygiene data straight from Defender. No external inventory dumps, no AD scripting, just KQL.

Passwords on Anything About IT

Exploring IdentityAccountInfo - Building a KQL Query to Assess Identity Password Security Posture