MC1484009: Microsoft Defender for Office 365: New email submissions data in Advanced Hunting
Published . Last updated .
Microsoft 365 Message Center announcement MC1484009.
MS Message Center's Summary
Microsoft Defender for Office 365 is introducing two new Advanced Hunting tables named SubmissionEvents and SubmissionResults in October 2026. These tables give security operations teams deeper visibility into email submissions and results. Administrators should inform security analysts about this new capability to improve threat hunting workflows and custom detection rules. No immediate configuration changes are required.
- Administrator impact
- No direct administrator action is required.
- End user impact
- No direct end user impact is expected.
- Importance
- 3/10: This is a new informational feature release that enhances threat hunting capabilities without causing service disruption or requiring urgent configuration.
Microsoft Summary
Microsoft Defender for Office 365 will add two new Advanced Hunting tables—SubmissionEvents and SubmissionResults—providing enhanced visibility into email submission activity. Public Preview starts mid-November 2026; General Availability begins late November 2026. No immediate action or compliance concerns are required.
- Message Center ID
- MC1484009
- Category
- stay Informed
- Severity
- normal
- Services
- Microsoft Defender XDR
- Tags
- Updated message, New feature, Admin impact
- Expires
Updated October 28, 2026: We have updated the timeline. Thank you for your patience.
What and Why
Microsoft Defender for Office 365 is introducing new email submissions data in Advanced Hunting in Microsoft Defender. The new submissions tables provide security operations teams with greater visibility into email submission activity and results, enabling analysts to query submission activity alongside other Defender data and build hunting and detection workflows tailored to their organization.
Rollout Schedule
Public Preview (Worldwide): We will begin rolling out in mid-November 2026 (previously early October 2026 and expect to complete by early December 2026 (previously early October).
General Availability (Worldwide): We will begin rolling out late November 2026 (previously late October) and expect to complete by mid-December 2026 (previously mid-November).
Impact on Your Organization
Who is affected:
- Security operations teams that use Advanced Hunting in Microsoft Defender.
- Admins and analysts who investigate email submissions and submission results.
Platforms/Services:
- Microsoft Defender for Office 365
- Microsoft Defender XDR
- Advanced Hunting
What will happen:
- Two new Advanced Hunting tables will be available: SubmissionEvents and SubmissionResults.
- SubmissionEvents provides information about email submission events.
- SubmissionResults provides information about the results associated with those submissions.
- Security teams can query submission information directly and correlate it with other Microsoft Defender XDR data.
- The tables can be used with Advanced Hunting custom detections, allowing organizations to create detections based on submission activity that is important to their SOC workflows.
Action Required/Recommendations
No immediate action is required. Additional documentation for the new tables will be provided as part of the release.
Compliance considerations
No compliance considerations identified. Review as appropriate for your organization.