Cloud Discovery anomaly detection policy to be retired

Microsoft has announced that the "Cloud Discovery anomaly detection" policy in Defender for Cloud Apps will be retired due to the high rate of false positives it generates. The company found that the policy was not contributing effectively to the overall security of organizations, and was not aligned with their strategic focus on delivering high-quality, reliable security solutions. The retirement will take place gradually between June and July 2024. Users should switch to the "App discovery policy" and set filters as needed. SOC administrators and analysts will no longer be able to access, manage and use the "Cloud Discovery anomaly detection policy" alerts in Microsoft Defender for Cloud Apps, after this change is implemented.

Microsoft recommends using the "App discovery policy" instead and creating dedicated policies, under "Trigger a policy match if all the following occur on the same day", setting filters accordingly. Users can refer to Cloud Discovery anomaly detection policy Message ID: MC783218 for additional information.

The post Cloud Discovery anomaly detection policy to be retired appeared first on M365 Admin.