Title: Admins’ Microsoft 365 Defender portal Advanced Hunting may not show some updated values in two columns for EmailEvents
User impact: Admins’ Microsoft 365 Defender portal Advanced Hunting may not show some updated values in two columns for EmailEvents.
More info: Some admins using EmailEvents from the Email & collaboration schema in the Microsoft 365 Defender portal’s Advanced Hunting may be unable to view some updated values in the LatestDeliveryLocation and LatestDeliveryAction columns for some Microsoft Defender for Office 365 records. Additionally for these records, RecipientEmailAddress in EmailPostDeliveryEvents aren’t in lowercase, which won’t allow some admins to join EmailPostDeliveryEvents and EmailEvents using RecipientEmailAddress. Admins will have to manually convert the data to lower case and join.
Current status: We’re progressing with the final validations of our fix to ensure that its deployment doesn’t result in any unexpected problems for the service. We’re expecting that we’ll complete the validations and have an estimated timeline for the fix deployment and the remediation of impact by our next scheduled update.
Scope of impact: Impact may occur for some admins attempting to view some updated values in Microsoft Defender for Office 365 columns.
Start time: Tuesday, August 22, 2023, at 12:00 AM UTC
Root cause: A data inconsistency caused by a coding issue is occurring in a section of infrastructure, responsible for RecipientEmailAddress values in the post-delivery events via Microsoft Defender for Office 365 that flow into EmailPostDeliveryEvents, resulting in impact.
Next update by: Friday, October 6, 2023, at 5:00 PM UTC
