254 questions with Microsoft Defender for Identity-related tags

Sort by: Updated
Updated Created Answers
1 answer One of the answers was accepted by the question author.

Travel Alerting

So I am a little familiar with Atypical Travel Alerts and Impossible Travel. Is there a way to setup just travel alerts? The Example a U.S. Employee was only hired in to work remotely in the U.S. So i would only expect U.S. based locale data. Is there…

Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
254 questions
asked 2025-04-24T17:04:42.3866667+00:00
Bilal Beyah 20 Reputation points
accepted 2025-05-01T18:46:45.1933333+00:00
Bilal Beyah 20 Reputation points
0 answers

How to remove AV instance registry entry as i am not able to access this path getting access denied

Hi, I am using trellix AV and while installing agent malware protection AV created having WMI instance and registry entry under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av but after running Trellix AgentCleanupTool.exe it removes…

Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
254 questions
asked 2025-04-29T07:38:27.05+00:00
SIMRAN SINGH 0 Reputation points
edited the question 2025-04-29T08:03:16.26+00:00
SIMRAN SINGH 0 Reputation points
0 answers

How to load the Azure IP address list for east us 2 into the hunting query "Detect Azure RemoteIP"

in the Defender dashboard in Azure, under Hunding , advanced Hunting, Queries, General Queries, Detect Azure RemoteIP I downloaded the .json file that is the list of all IP address ranges. I copied the ip address list for east us 2 and pasted it into…

Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
254 questions
asked 2025-04-28T17:08:05.2366667+00:00
AustinBits 0 Reputation points
edited the question 2025-04-28T17:09:07.5333333+00:00
AustinBits 0 Reputation points
1 answer

My windows defender is not working properly

i have just configured that agent also enable the protaction mode but when some file which is unauthorised, that file is not deleted, and my server is compromised pls look into it or just set up a call for this ASAP

Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
254 questions
asked 2025-04-24T10:03:32.4866667+00:00
AzureAdmin 0 Reputation points
edited the question 2025-04-28T09:49:02.12+00:00
Givary-MSFT 35,591 Reputation points Microsoft Employee
1 answer

Microsoft Defender Vulnerability Management is not displaying accurate Exposed Devices count

<< NOTE: This relates to Microsoft Defender for Endpoint but there isn't a child tag available for that >> The Weaknesses table in Microsoft Defender Vulnerability Manager is indicating that there are exposed devices, but when I open the…

Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
254 questions
asked 2025-04-25T14:42:46.5966667+00:00
Tom Burton 5 Reputation points
answered 2025-04-28T06:54:15.6533333+00:00
Catherine Kyalo 1,305 Reputation points Microsoft Employee
1 answer

Duplicate SecurityEvent logging after migrating from MMA to AMA

Greetings, I added a few extra tags to this as we are not quite sure of why we cannot Disconnect or Delete the Security Events Via the Legacy Agent Connector from our Sentinel environment. All Azure VMs have been migrated from the MMA (Legacy) agent to…

Microsoft Defender for Cloud
Microsoft Defender for Cloud
An Azure service that provides threat protection for workloads running in Azure, on-premises, and in other clouds. Previously known as Azure Security Center and Azure Defender.
1,529 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,268 questions
Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
254 questions
asked 2024-12-06T20:24:41.8566667+00:00
mpls 135 Reputation points
commented 2025-04-16T13:57:25.2766667+00:00
Jonas Hosni 0 Reputation points
0 answers

MS Defender - How to manage Tenant Allow/Block Lists with graph api

Hi, I'm trying to create an integration to block certain URLs on Microsoft Defender with the Graph API. After looking into the documentation, I found this endpoint:…

Microsoft Graph
Microsoft Graph
A Microsoft programmability model that exposes REST APIs and client libraries to access data on Microsoft 365 services.
13,541 questions
Microsoft Defender for Cloud
Microsoft Defender for Cloud
An Azure service that provides threat protection for workloads running in Azure, on-premises, and in other clouds. Previously known as Azure Security Center and Azure Defender.
1,529 questions
Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
254 questions
asked 2024-07-10T08:21:08.0666667+00:00
Omer Dital 15 Reputation points
commented 2025-04-02T03:10:29.5033333+00:00
Lucas Krupinski 10 Reputation points
2 answers One of the answers was accepted by the question author.

How to resolve about Sentinel and XDR not connecting properly.

We are currently doing integration testing between Sentinel and XDR. After onboarding and offboarding the workspace from XDR side several times ,following the steps provided in Microsoft's official documentation, encountered the following…

Microsoft 365
Microsoft 365
Formerly Office 365, is a line of subscription services offered by Microsoft which adds to and includes the Microsoft Office product line.
5,771 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,268 questions
Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
254 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
24,382 questions
asked 2024-11-23T16:11:42.9666667+00:00
Ryo Suzuki 25 Reputation points
commented 2025-03-31T07:02:06.6933333+00:00
Shubham Pandey 0 Reputation points
1 answer One of the answers was accepted by the question author.

What does the Defender Anti-Spam (Inbound) policy overrule?

The Defender Anti-Spam, Anti-Malware and Anti-Phish policies all sit together in the Email Policy and Rules section, but I am trying to understand what an exception to these policies would over rule? Mainly looking at the Anti-Spam Policy, as that is…

Microsoft 365
Microsoft 365
Formerly Office 365, is a line of subscription services offered by Microsoft which adds to and includes the Microsoft Office product line.
5,771 questions
Microsoft Intune Security
Microsoft Intune Security
Microsoft Intune: A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
492 questions
Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
254 questions
asked 2025-01-28T12:27:10.4433333+00:00
Josh 40 Reputation points
accepted 2025-03-20T15:11:19.8766667+00:00
Josh 40 Reputation points
1 answer

Microsoft Defender for identity auto disable user account.

Hello, Recently, we are experiencing a lot of user accounts being automatically disable by Microsoft Defender for Identity when they authenticated by Exchange Online. Somehow, Defender think the user's accounts being attacked, and just disabled users…

Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
254 questions
asked 2025-02-06T20:10:58.3766667+00:00
brichardi 336 Reputation points
answered 2025-03-19T10:04:09.16+00:00
Catherine Kyalo 1,305 Reputation points Microsoft Employee
0 answers

Data connector buttons are grayed out saying No permissions

cannot enable Microsoft Defender XDR connector in sentinel despite being logged in as owner of tenant, subscription and resource group. My licence is Microsoft 365 Business Premium which I see in documentation is an Microsoft XDR eligible licence

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,268 questions
Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
254 questions
asked 2025-02-13T12:41:56.3866667+00:00
gutta bachelor 0 Reputation points
commented 2025-03-18T18:00:51.3633333+00:00
Catherine Kyalo 1,305 Reputation points Microsoft Employee
1 answer

Need IOC's

Hi MSTeam, Can i have IOC's for the vulnerability "CVE-2024-21413" to hunt.

Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
254 questions
asked 2025-02-18T17:33:45.1166667+00:00
Deepak S 0 Reputation points
edited an answer 2025-03-18T11:58:49.1333333+00:00
Catherine Kyalo 1,305 Reputation points Microsoft Employee
4 answers

Security Recommendations for LAPS are outdated

These recommendations in the Microsoft Secure Score seems to be ignoring the new Windows LAPS and looking at the old LAPS. When we changed over to the Windows LAPS, these recommendations started getting flagged. I thought Microsoft would eventually…

Windows
Windows
A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.
5,823 questions
Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
13,726 questions
Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
254 questions
asked 2023-06-28T10:54:09.08+00:00
ADM-Griffin2, Jay 151 Reputation points
commented 2025-03-14T09:28:17.5366667+00:00
Stijn D'haese 0 Reputation points
4 answers

Defender for Identity Radius Aad Syncer Disabling User Accounts - Not Sure Why?

We have users randomly getting disabled and the audit logs are showing that Radius Aad Syncer is the culprit. The logs don't offer much more information so I'm not sure how to approach troubleshooting this, but a growing number of users are affected.

Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
254 questions
asked 2024-12-17T17:23:47.1333333+00:00
K12SysAdmin 11 Reputation points
answered 2025-03-10T17:51:56.9833333+00:00
Gavin Stevens 0 Reputation points
2 answers

Why defender is not correlating the Entra ID protection alerts?

Hi Team, In my environment, Entra ID Protection is generating multiple alerts even when the user, IP address, and sign-in events are the same and occur within seconds. These alerts are forwarded to Microsoft Defender, but they are not being correlated,…

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,268 questions
Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
254 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
24,382 questions
asked 2025-02-17T14:53:42.8366667+00:00
Supriya Nelluri 0 Reputation points
commented 2025-03-07T10:16:40.2733333+00:00
Sakshi Devkante 3,335 Reputation points Microsoft External Staff
2 answers

Issue with Attack Simulator - Not all targeted users showing up

Hello, I'm currently experiencing issues with the Attack Simulator. I'm running a phishing simulation, and I've selected the "Include all users in my organization" option, which should total to 193 users. However, the pages are only adding up…

Microsoft 365
Microsoft 365
Formerly Office 365, is a line of subscription services offered by Microsoft which adds to and includes the Microsoft Office product line.
5,771 questions
Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
254 questions
asked 2023-08-19T16:28:50.4133333+00:00
Maxxxi 5 Reputation points
commented 2025-03-06T20:11:14.37+00:00
Andrew Schuch 0 Reputation points
2 answers

Defender for Identity - Directory Services Advanced Auditing is not enabled

Hi Everyone, We have followed the following guide from Microsoft in regards to enabling "advanced auditing" for Defender for Identity: https://learn.microsoft.com/en-us/defender-for-identity/configure-windows-event-collection However, we keep…

Windows
Windows
A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.
5,823 questions
Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
6,942 questions
Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
254 questions
asked 2023-09-27T20:12:12.2233333+00:00
OwlTecAB 60 Reputation points
commented 2025-02-28T14:55:10.81+00:00
Carlton Whitmore 26 Reputation points
1 answer

Duplicated Defender AAD Identity Protection alerts due to different sign-in request ID in milliseconds

Hi, We are seeking some advise regarding the duplication alerts in our defender portal. Any help is greatly appreciated. Subject: Duplicated Defender AAD Identity Protection Alerts Due to Different Sign-In Request IDs in Milliseconds Alert Name:…

Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
6,942 questions
Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
254 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
24,382 questions
asked 2025-02-07T13:18:23.58+00:00
Joey W 0 Reputation points
edited a comment 2025-02-20T14:52:25.8666667+00:00
Sakshi Devkante 3,335 Reputation points Microsoft External Staff
3 answers

Privacy protection VPN option is not visible on my Microsoft defender

Privacy protection VPN option is not visible on my Microsoft defender. Earlier I was used now it's not visible, I have 365 personal plan

Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
254 questions
asked 2024-12-10T00:50:54.28+00:00
Thirumal Vellingiri 10 Reputation points
commented 2025-02-20T05:49:50.72+00:00
Kimberly Traven 0 Reputation points
2 answers

How can I investigate risky sign in's to determine if an account is actually compromised?

I am trying to determine why some user sign in's are flagged as risky. When I check the IP address that was associated with the sign in, most of the time it is from a GTHost server. Our users are mostly using iPhones and trying to log into the…

Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
254 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
24,382 questions
asked 2025-02-13T20:38:55.3966667+00:00
Carrie Ives 6 Reputation points
answered 2025-02-19T16:48:51.0366667+00:00
Carrie Ives 6 Reputation points