Advisory: Microsoft 365 User ID Case Change
On November 13, 2025, Microsoft briefly changed the user ID in the Office 365 audit feed to all lowercase. For users whose usernames contain capital letters, Fluency saw the lowercase name as a new user, so O365_AzureAD_UserLoggedIn and other rules that key on the field raised false positives.
No action is needed. Alerts raised during that window for this reason can be closed as false positives.