(Updated) Introducing new Advanced Hunting Tables to hunt on Teams messages and URLs

Introducing three new Advanced Hunting tables for Teams messages and URLs: MessageEvents, MessagePostDeliveryEvents, and MessageURLInfo. Public Preview starts late April 2025, with General Availability in early July 2025. No additional action is needed; tables will be available with the right security permissions.

Updated June 5, 2025: We have updated the timeline below. Thank you for your patience.

We are happy to introduce three new Advaned Hunting tables designed to facilitate hunting of Teams messages containing URLs within your organization. 

• The MessageEvents table enabled hunting across Teams messages containing URLs within your tenant. This includes both, known malicious messages blocked immediately after delivery and messages with no malicious content. Each message is uniquely identified by the TeamsMessageId, which can be utilized to establish joins across tables. As there is only a single copy of each message, even in instances of delivery to multiple recipients, only one instance of the message will be accessible for viewing in Advanced Hunting.
• The MessagePostDeliveryEvents table provides the capability to analyze Teams messages containing URLs within your tenant, that have been identified as malicious after message delivery. If you have Zero-hour Auto Purge (ZAP) enabled for Teams, messages blocked post-delivery will be observable within this table. Each message is uniquely identified by the TeamsMessageId.
• The MessageURLInfo table support the ability to hunt across URLs embedded within Teams messages in your organization.

The tables can be found under the Email & Collaboration in Advanced Hunting.

This change is associated with Microsoft 365 Roadmap ID: 487411.

[When this will happen:]

Public Preview (Worldwide): We will begin rolling out late April 2025 and expect to complete by mid-May 2025.

General Availability (Worldwide): We will begin rolling out in early July 2025 (previously late May) and expect to complete by mid-August 2025 (previously mid-June).

[How this will affect your organization:]

You will now have the ability to hunt on Teams messages from Advanced Hunting. 

[What you need to do to prepare:]

No additional action will be needed to prepare for this rollout. The new hunting tables will be available in your tenant and can be viewed with the right security permissions.

More information on these new tables can be found here:

• MessageEvents: MessageEvents table in the advanced hunting schema - Microsoft Defender XDR | Microsoft Learn
• MessagePostDeliveryEvents: MessagePostDeliveryEvents table in the advanced hunting schema - Microsoft Defender XDR | Microsoft Learn
• MessageURLInfo: MessageUrlInfo table in the advanced hunting schema - Microsoft Defender XDR | Microsoft Learn