Loading table information…
Contribute structured examples for this table using the PowerShell tool. Submit a synthetic example.
MessageUrlInfo Schema
Table description
| TableSection | TableType | TableSectionName | Description | Source |
|---|---|---|---|---|
| Emails | Regular | Contains information about URLs sent through messages | Defender |
Table retention
| ColdDays | HotDays | TotalInteractiveDays |
|---|---|---|
| 0 | 30 | 30 |
Schema
| Name | Description | Type |
|---|---|---|
| ReportId | Unique identifier for the event | String |
| SourceSystem | String | |
| TeamsMessageId | Unique identifier for the message generated by Office 365 | String |
| TenantId | String | |
| TimeGenerated | DateTime | |
| Timestamp | Date and time when the record was generated | DateTime |
| Type | String | |
| Url | URL from message | String |
| UrlDomain | Domain name or host name of the URL | String |
| UrlLocation | Indicates which part of the Teams message the URL is located | String |
Schema changes
| Date | Action |
|---|---|
| 2026-10-12 | Column UrlLocation added |
| 2026-10-07 | Column TenantId added |
| 2026-10-07 | Column Type added |
| 2026-10-07 | Column SourceSystem added |
| 2026-10-07 | Column TimeGenerated added |
| 2026-02-27 | Column TenantId removed |
| 2026-02-27 | Column Type removed |
| 2026-02-27 | Column SourceSystem removed |
| 2026-02-27 | Column TimeGenerated removed |
| 2026-01-02 | Table added to tracking |
Known observations
Value casing varies
Fields: Url.
Values in this field have been observed with different casing. Choose comparison behavior according to the meaning of the value and the query intent.
Sources: Olaf Hartong.