← Browse all tablesLoading table information…
UrlClickEvents Schema
Table description
| TableSection |
TableType |
TableSectionName |
Description |
| Emails |
Regular |
|
Events involving URLs clicked, selected, or requested on Microsoft Defender for Office 365 |
Table retention
| ColdDays |
HotDays |
TotalInteractiveDays |
| 0 |
30 |
30 |
Schema
| Name |
Description |
Type |
| AccountUpn |
User principal name (UPN) of the account |
String |
| ActionType |
Type of activity that triggered the event |
String |
| AppName |
The application’s display name as exposed by the associated service principal |
String |
| AppVersion |
Version of the client application where click occurred |
String |
| DetectionMethods |
Methods used to detect whether the URL contains or leads to malware, phishing, or other threats |
String |
| IPAddress |
IP addresses of the clients on which the activity was performed; can contain multiple Ips if related to Microsoft Defender for Cloud Apps alerts |
String |
| IsClickedThrough |
Indicates whether the user was able to click through to the original URL or not |
Boolean |
| NetworkMessageId |
Unique identifier for the email from which the URL was clicked |
String |
| ReportId |
Unique identifier for the event |
String |
| SourceId |
Unique identifier for the source of the click |
String |
| SourceSystem |
|
String |
| TenantId |
|
String |
| ThreatTypes |
Verdict on whether the URL leads to malware, phishing, or other threats |
String |
| TimeGenerated |
|
DateTime |
| Timestamp |
Date and time when the record was generated |
DateTime |
| Type |
|
String |
| Url |
URL that was clicked |
String |
| UrlChain |
List of URLs in the redirection chain |
String |
| Workload |
The Microsoft 365 service where the event occurred |
String |
Action types
| Name |
Description |
| ClickAllowed |
The user was allowed to navigate to the URL. |
| ClickBlocked |
The user was blocked from navigating to the URL. |
| ClickBlockedByTenantPolicy |
The user was blocked from navigating to the URL by a tenant policy. |
| UrlErrorPage |
The URL the user clicked showed an error page. |
| UrlScanInProgress |
The URL the user clicked is being scanned by Safe Links. |
Schema changes
| Date |
Action |
| 2026-10-07 |
Column TenantId added |
| 2026-10-07 |
Column Type added |
| 2026-10-07 |
Column SourceSystem added |
| 2026-10-07 |
Column TimeGenerated added |
| 2026-02-27 |
Column TenantId removed |
| 2026-02-27 |
Column Type removed |
| 2026-02-27 |
Column SourceSystem removed |
| 2026-02-27 |
Column TimeGenerated removed |
| 2026-01-02 |
Column _IsBillable removed |
| 2026-01-02 |
Column _BilledSize removed |
| 2026-01-02 |
Column AppName added |
| 2026-01-02 |
Column AppVersion added |
| 2026-01-02 |
Column SourceId added |
| 2024-10-18 |
Table added to tracking |