Microsoft Defender: Changes to Defender for Cloud Apps alerts
Coming soon for Microsoft Defender for Cloud Apps: A change to alerts generated by events originating from Defender for Cloud Apps that are generated in the Microsoft Defender XDR detection engine A change to App governance alerts This rollout aims to provide more accurate and precise information on the origin of these alerts, enabling customers to identify, manage, and respond to alerts more effectively. When this will happen: General Availability (GCC, GCC High, DoD, Production, DoD): We will begin rolling out early March 2025 and expect to complete by early April 2025. How this will affect your organization: We will change the field indicating the alert source in the alert data itself. Note: The rollout will only affect new alerts generated after the rollout and will not alter existing alerts. This rollout will be reflected in all experiences where alerts are represented, including Incidents & alerts queues in the XDR portal, Advanced hunting, and the correlating APIs and SIEM systems. In the Defender XDR portal, the change will be reflected in the Service sources field, replacing the current Microsoft Defender XDR and App governance values with the new value Defender for Cloud Apps. The detection sources will remain unchanged and will continue to indicate the detections are generated in the XDR detection engine, App governance policy, or App governance detection. The alert ID prepended characters of some of the alerts will also be changed to comply with the Defender XDR mapping. Service/Detection sources filter in the Incidents queue. Left: Before the change. Right: After the change: View image in new tab Learn more about the different alert sources in Defender XDR in the Alert sources section of Investigate alerts in Microsoft Defender XDR – Microsoft Defender XDR | Microsoft Learn In the Microsoft Graph API, Microsoft Defender for Endpoint streaming API, and the Microsoft Azure Events Hub, the change will be reflected in the alert resource type under the property serviceSource, and the previous values of microsoft365Defender and microsoftAppGovernance will change to microsoftDefenderForCloudApps. Learn more about the Graph API alert resource: alert resource type – Microsoft Graph v1.0 | Microsoft […]
The post Microsoft Defender: Changes to Defender for Cloud Apps alerts appeared first on M365 Admin.
Published on:
Learn moreWe can help you with Microsoft Defender: Changes to Defender for Cloud Apps alerts
If you want help implementing, troubleshooting, or improving this product, contact us and we’ll point you in the right direction.
Related posts
Microsoft 365: [Education] Microsoft Learning Zone – Improve Lesson Insights
See where your class is struggling and which students need support, with lesson-level results for every student. Aggregated responses show the...
Dynamics 365 Project Operations: Invoice usability enhancements
When billing teams review an invoice, they need to see where it stands, which transactions it includes, and what’s still waiting to be b...
Dynamics 365 Commerce: Unified Pricing Management – Require manager approval for price overrides and manual discounts that exceed margin limits
Retailers can protect their profitability without slowing down store operations. Sales associates can still adjust prices to close a sale. Any...
Dynamics 365 Finance: Faster cube data loading with optimized dataflows
The Matrix visual now provides clearer control over how zero and blank values are handled during planning. Users can explicitly save 0 as a pl...
Dynamics 365 Commerce: Unified Pricing Management – Attribute-based margin thresholds and tiers for approvals and reporting
Pricing managers can set margin controls that match how the business actually sells, instead of one threshold for everything. Each product, ch...
Microsoft SharePoint Online and OneDrive for the web: Updated search experience with Copilot Search
SharePoint Online and OneDrive on the web are updating to a unified Copilot Search experience with natural-language prompts, AI summaries, and...
Microsoft Teams: Automatically add tag members to channels with Workflows
Microsoft Teams will introduce a Workflows app template to automatically add users to channels when they are added to a team tag. This optiona...
Microsoft SharePoint: Data access governance report for group permissions
Microsoft SharePoint is introducing a Data access governance report in the admin center to help administrators identify sites accessible to sp...
Action required: Exchange Online Admin API MailboxFolderPermission response update
Microsoft will update the Exchange Online Admin API v2.0 MailboxFolderPermission endpoint to return the User property as a structured object w...
Microsoft Planner: Planner capabilities in Copilot Cowork through the Planner Plugin
The Planner Plugin integrates Microsoft Planner with Copilot Cowork, enabling task prioritization, completion assistance, plan creation, visua...