Configuration Change – Microsoft Defender for Cloud Apps threat protection policies

Microsoft is making changes to the default threat protection policies for Microsoft Defender for Cloud Apps. These policies will now be disabled by default and will be sent as "behaviors," a new data type that can be enriched and correlated with other signals to trigger alerts with higher confidence. This is due to the fact that Microsoft Defender for Cloud Apps is now part of Microsoft 365 Defender XDR, and the transition to "behaviors" will provide an enhanced level of cloud application threat protection. However, organizations will still be able to create alerts that apply to the policy logic by manually re-enabling the policies or creating Microsoft 365 Defender advanced hunting custom detection on the relevant behaviors. More information on "behaviors," including querying and creating custom detections, can be found in the documentation. In the future, Microsoft Defender for Cloud Apps is expected to shift from policy-based out-of-the-box threat detections to a more proactive approach.

For organizations using Microsoft Defender for Cloud Apps, it is essential to keep up to date with these changes to ensure the appropriate level of threat protection for their cloud applications.

The post Configuration Change – Microsoft Defender for Cloud Apps threat protection policies appeared first on M365 Admin.