Defender policies disabled by Microsoft?

Posted by Sunsparc@reddit | sysadmin | View on Reddit | 4 comments

Has anyone else noticed that a ton of their Defender detection policies were disabled on Nov 12th by Microsoft? We have a ton showing disabled, including a crucial one "Impossible travel activity". We definitely did not disable them.

Reply to Post

4 Comments

[-]

H-Bernhard@reddit

On the top of the policies page it states: *Azure AD identity protection policies have been removed from the Defender for Cloud Apps policy list. To configure alerts from these policies,* *edit the global alert service settings* Might be this?

[-]

Sunsparc@reddit (OP)

Yeah I just saw that a few minutes ago. I'm trying to find some sort of documentation as to when that actually took place and the policy was disabled.

[-]

Angeloogle7@reddit

Did you ever figure anything out..I'm in this same place right now.

[-]

Sunsparc@reddit (OP)

These are now called Behaviors.