Issue Summary: KQL Syntax and Semantic Regression in Analytics Rule Template Upgrade

[TwoPump]

Source Template Version: 2.1.07
Target Template Version: 2.1.11
Impacted Detection: "Successful logon from IP and failure from a different IP"

Problem Description
Upgrading the analytics rule template from version 2.1.07 to 2.1.11 introduces critical syntax errors and broken schema pipelines that cause the query to fail compilation in Azure Sentinel / Log Analytics/Defender XDR.

Observed Error Messages

Validation Error: 'summarize' operator: Failed to resolve scalar expression named 'AccountUPN'

Execution Error: An unexpected error occurred during query execution. Please try again in a few minutes.

Semantic Error (Failed to resolve scalar expression 'AccountUPN'):Inside the IdentityInfo subquery block, a project operator was introduced directly after an arg_max aggregation

Steps to Reproduce
Deploy the "Successful logon from IP and failure from a different IP" analytic rule from Content Hub using template version 2.1.11.
Attempt to run the query in the Log Analytics editor.
Observe the query validation failure or the unexpected execution crash message.

Requested Action
Please patch the 2.1.11 template in the Microsoft Sentinel repository to remove the broken project step within the IdentityInfo join, and fix the split() array indexing logic so the rule can execute cleanly without crashing the query engine.

Alternatively, please provide the original 2.1.07 template version of this KQL query so that it can be temporarily redeployed to unblock our detection engineering pipeline while this regression is investigated.

Thank you

[TwoPump]

Hello

Could someone please provide an update?

Thanks

[v-utpalkumar]

Hello @TwoPump, apologies for the delayed response!

It seems that the error is not a bug in the query syntax — it means the IdentityInfo table does not exist in the Log Analytics workspace where you ran it.

The query joins to two tables that only exist when Microsoft Sentinel UEBA (User and Entity Behavior Analytics) is enabled:

• IdentityInfo
• BehaviorAnalytics

If UEBA has never been turned on for that workspace, those tables are never provisioned, so KQL can't resolve the name IdentityInfo and summarize fails.

How to resolve

• Enable UEBA: In the Microsoft Sentinel portal go to Settings → Entity behavior and turn it on. This provisions IdentityInfo and BehaviorAnalytics. Allow some time for the tables to populate, then re-run the rule.

See Enable User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel for more information: Enable entity behavior analytics to detect advanced threats | Microsoft Learn

About Advanced threat detection with User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel: Advanced threat detection with User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel | Microsoft Learn

UEBA tables: Advanced threat detection with User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel | Microsoft Learn

IdentityInfo table: Microsoft Sentinel User and Entity Behavior Analytics (UEBA) reference | Microsoft Learn

BehaviorAnalytics Table attributes: Azure Monitor Logs reference - BehaviorAnalytics - Azure Monitor | Microsoft Learn

Rule for the issue raised: https://github.com/Azure/Azure-Sentinel/blob/2d2940309d6d6301ae8be95d0aea433b850073ce/Solutions/Microsoft%20Entra%20ID/Analytic%20Rules/SuccessThenFail_DiffIP_SameUserandApp.yaml

Please read the instructions and documentations carefully, and follow each step as outlined. This should hopefully resolve the issue you're experiencing. Thank you!

[TwoPump]

Hi @v-utpalkumar

Thanks for the detailed response, and acknowledge the details provided you provided.

I confirm that my current environment has UEBA enabled, and both the IdentityInfo and BehaviorAnalytics tables are active with data available.

Can you please advise the next steps.

Cheers

[v-utpalkumar]

Hello @TwoPump,

Thank you for confirming that UEBA is enabled in your environment and that both the IdentityInfo and BehaviorAnalytics tables are present and populated.
We reviewed the analytic rule and verified that the fields referenced from both tables are still available and align with the current Microsoft documentation and table schema. We also validated the rule in our environment with UEBA enabled, and the query executed successfully without any error.

For reference, we've included:

• Screenshots of the IdentityInfo table fields referenced by the analytic rule from the documentation and the table schema.

  

• Screenshots of the BehaviorAnalytics table fields referenced by the analytic rule from the documentation and the table schema.

  

• Evidence showing the analytic rule (Version 2.1.11) executing successfully in our environment.

  

At this point, I kindly request that you review the configuration steps and prerequisites outlined in the Microsoft documentation referenced in our previous response to ensure your environment is configured as expected. This should allow the rule to be triggered successfully on your end as well.
Our investigation did not reveal any issues with the analytic rule. Therefore, we will proceed with closing this GitHub issue for now. If you need any further assistance, please feel free to reopen this GitHub issue at any time, and I'll be happy to help.

Thank you for your patience and support!