Microsoft Defender for Identity: Unified identity timeline on the Identity page
Microsoft Defender for Identity will provide a unified chronological view of identity-related activity and alerts across integrated Microsoft security products, including sign-ins, audit events, and device logons with enhanced filtering and context. This is a new capability currently in development with no immediate action required.
Microsoft's description
The updated identity timeline provides security teams with a single chronological view of activity and alerts associated with an identity and its linked accounts. It normalizes activity from integrated Microsoft security products, including Microsoft Entra sign-ins, Microsoft Graph audit events, SaaS and cloud activity, and device logons. New fields and filters include Source table, Session ID, and Unique token identifier, with expanded Conditional Access and event context.