Microsoft Defender for Cloud Apps: Improvements to threat protection capabilities

Microsoft Defender for Cloud Apps will enhance threat protection with a new dynamic model for detections and alerts, rolling out from June to July 2025. This model allows faster response to threats and will be implemented seamlessly. Legacy policies will be disabled but visible temporarily. No admin action is required. Coming soon for Microsoft Defender for Cloud Apps: Improvements to threat protection capabilities. We will implement a new dynamic model for threat protection detections and alerts. This change aims to improve and maintain a high signal-to-noise Ratio (SNR) for detections. When this will happen: General Availability (Worldwide, GCC, GCC High, DoD): We will begin rolling out the first batch of policies early June 2025 and expect to complete by early July 2025. How this will affect your organization: Our new dynamic model allows our security researchers an ability to respond faster to new threats, to update detection logic based on the evolving threat landscape. This means that detections can be added, removed, or modified dynamically to ensure optimal protection against emerging threats. Note: These are research-driven detections, so Customers will enjoy the protection without the need to actively configure them. This rollout will be seamless, and you will continue to receive the same standard of protection without disruption to the provided security coverage. After rollout begins, we will include the migrated policies in Create anomaly detection policies – Microsoft Defender for Cloud Apps | Microsoft Learn (to be updated). The first batch of policies will be: Suspicious inbox manipulation rule Suspicious email deletion activity Suspicious email forwarding rule Activity from an anonymous proxy Activity from a botnet-associated IP address Note: In addition to the policies in the first batch mentioned above, all other OOTB policies will eventually be migrated to the new dynamic model. After this rollout: What you need to do to prepare: This By applying the new dynamic model, we aim to provide more accurate and timely threat detections, enhancing your overall organization security. In some cases, policies may be split into several different detections and alerts in order to provide an additional degree of protection and better […]

The post Microsoft Defender for Cloud Apps: Improvements to threat protection capabilities appeared first on M365 Admin.