Blog Post

Microsoft Security Community Blog
3 MIN READ

MCAS: Top 5 Queries You Need to Save

Caroline_Lee's avatar
Caroline_Lee
Icon for Microsoft rankMicrosoft
Apr 20, 2021
By: erinboris Caroline_Lee    Hi Everyone!   After speaking with a few of our customers, we realized that some were not familiar or aware of their ability to leverage suggested and saved quer...
Updated Nov 02, 2021
Version 5.0
cloud security
microsoft defender for cloud apps
Anders Olsson's avatar
Anders Olsson
MVP
Apr 23, 2021

Nice blog post!
Regarding Use Case 3 I missing the activity when a user is enforced password change from the AAD Identity Protection User Risk policy. This would be the most common case for enforced password change.
By adding the activity "Confirm user compromised" you get the ones triggered by MCAS policies or manual but unfortunately not the ones from the user risk policy.