[Updated] Call to action: update automation by July 1, 2026 - Account Name is now consistently the UPN prefix for analytics rule alerts
Analysis / inference: Microsoft Sentinel is standardizing Account Name to the UPN prefix only, requiring updates to automation rules and playbooks by July 1, 2026.
- Dates
- Source and collection dates not recorded
- Source
- Microsoft Sentinel - What's new · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
Microsoft Sentinel is modifying analytics rule alert mapping so that when a full UPN is mapped to Account Name, the value will always be the UPN prefix exclusively, accompanied by new dedicated fields like UserPrincipalName and UPNSuffix in the SecurityAlert table.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisChanges to how account entity names are populated in Microsoft Sentinel analytics rules can break downstream automation logic, playbooks, and filters relying on strict UPN equality.
Logic Apps and automation rules utilizing strict equality checks against the AccountName property may fail or filter incorrectly once the schema formatting is enforced.
Section 03 · Recommended actions
- Update automation rules and Logic Apps to replace strict equality checks with operations like Contains or Starts with using the new UPN prefix and UPNSuffix fields.
- Review all existing automation rules and Logic Apps playbooks that parse or filter on the AccountName property in SecurityAlerts.
- Identify any strict equality checks comparing AccountName against full UPN strings.