Advisory: Microsoft 365 User ID Case Change
On November 13, 2025, Microsoft briefly changed the user ID in the Office 365 audit feed to all lowercase. For users whose usernames contain capital letters, Fluency saw the lowercase name as a new user, so O365_AzureAD_UserLoggedIn and other rules that key on the field raised false positives.
No action is needed. Alerts raised during that window for this reason can be closed as false positives.
What happened
The Office 365 Management Activity API, which feeds the Office 365 audit integration, carries the user's UPN in UserId, stored in Fluency as @fields.UserId. For a period on November 13, Microsoft sent that field in lowercase. Fluency builds each user's behavior baseline on this value, so Jane.Doe@example.com and jane.doe@example.com were treated as two different users, and the lowercase one was flagged as first seen.
How to recognise it
- The alert is a new-user or first-seen alert, such as
O365_AzureAD_UserLoggedIn, for a user who has worked in the tenant for a long time. - The username in the alert is all lowercase, while the user's earlier events show capital letters.
- The sign-in itself — IP address, ISP, location and device — matches the user's normal pattern.
Update — January 15, 2026
Microsoft made the same change again on January 15, 2026, and normalized UserId to lowercase. Besides first-seen user alerts, the change set off impossible-travel alerts in some tenants. The guidance is the same: alerts that match the pattern above can be closed as false positives.
Splash Summary
On November 13, 2025, Microsoft briefly changed the user ID in the Office 365 audit feed to all lowercase. For users whose usernames contain capital letters, Fluency saw the lowercase name as a new user, so O365_AzureAD_UserLoggedIn and other rules that key on the field raised false positives.
No action is needed. Alerts raised during that window for this reason can be closed as false positives.