Starting early October 2025, Microsoft Defender for Office 365's Streaming API and Sentinel EmailEvents table will store both current and historical email verdicts and locations, showing multiple records per email. Admins should update queries and dashboards accordingly, using KQL's arg_max to retrieve the latest records.
Applies to: Microsoft Defender XDR
Source: mc.merill.net — data via Merill Fernando's open archive (MIT).