Forum Widgets
Latest Discussions
MS Defender XDR API missing Alerts
The Microsoft Defender XDR API is missing Alerts that are visible in the console (https://security.microsoft.com). The number of Alerts returned by the Incident API is limits to 150. This information is no where in the documentation. If you have an Incident with greater than 150 Alerts, the API will not provide all the Alerts for a given Incident. https://learn.microsoft.com/en-us/defender-xdr/api-list-incidents My team has confirmed this behavior across hundreds of tenants and thousands of Incidents. MS Premier Support has not been helpful in understanding if this is a known issue or a bug. Has anyone encountered this issue and have any information? Obviously closing the Incident will solve the problem, but for ongoing investigations this is not alway an option.
Deploying Defender for Business without o365 accounts
Hi, I have few SMB customers, who due to nature of their buiness do not want/need o365 accounts. Beside, their company policy does not allow them to store any business data in clouds abroad. However, they all have their local AD domain and Windows-only environment. Now, I would like to setup Defender for Business + Huntress MDR as a good and affordable threat protection combo, but here my questions begin. Please, shed some light on this: Does Defender for Business actually need endpoint users to be actually signed-in into their o365 accounts for full protection to work properly? What if they aren't - would full protection still be in place, or would Defender for business functionality drop down to basic antivirus, like regular Defender? Is Defender for Business in my case really so complicated and hard to install and setup? I've read some instructions and there is a ton of documentation, Ps scripts and tools, like Intune and such and despite being 40+ years in computer engineering, I got lost. Mostly because I do not use a ton of Microsoft products daily. Does Defender for Business have some easy to manage Cloud management tool, where I would see and manage all installed Defenders for Business? Or must I learn those Intunes, Azure, o365 Security and Defender portals, which are total overkill for those SMB which I manage? Thank you!
Pending actions notification via KQL / Graph API
Hello, I'm looking for a way to get notifications when an investigation is in Pending Approval state. I have tried searching the logs in Defender and Sentinel and have tried finding a graph request that could get this information, but no luck. Is this something that exists? Thank you for any help regarding this topic. Kristof
Defender - Cloud Activity Logs suspicious
Hi, I just noticed this logs from Defender - Cloud Apps > Activity Logs, seems all our Microsoft Cloud PC has these logs, looks suspicious for me as it is querying our Domain Admins account it seems, but would like to confirm. If this is suspicious, can help how to mitigate this please, thank you.Tracking Sent Emails from a Shared Mailbox with Delegated Access
Here is a detailed post to the Microsoft help forum about tracking down who sent emails from a shared mailbox with delegated access and send as rights: Title: Tracking Sent Emails from a Shared Mailbox with Delegated Access Dear Microsoft Community, I'm reaching out for assistance with an issue I'm encountering regarding a shared mailbox in my organization. The shared mailbox has been configured with delegated access and "Send As" rights for certain users. However, I'm finding that emails are being sent from this shared mailbox, and I need to determine which user is responsible for those sent messages. Here's some more context on the setup: We have a shared mailbox that multiple employees within my organization can access and send emails from using their individual user accounts. The shared mailbox has been granted "Delegate Access" and "Send As" rights to these authorized users. Whenever an email is sent from the shared mailbox, it appears to come from the shared mailbox address rather than the individual user's email address. I need to be able to track down and identify which user sent a specific email from the shared mailbox. My main questions are: How can I determine which user account was used to send a specific email from the shared mailbox? Is there logging or audit functionality within Microsoft 365 that would allow me to see the user who sent an email from the shared mailbox? Are there any third-party tools or add-ons that could provide this level of tracking and visibility for emails sent from a shared mailbox? I'm hoping the Microsoft community can provide some guidance and recommendations on the best approach to resolve this issue. Being able to identify the user responsible for emails sent from the shared mailbox is crucial for maintaining security and accountability within our organization. Thank you in advance for your assistance. I look forward to hearing back from the community. Best regards,
Administrative activity from a non-corporate IP address
Hi, Defender XDR raises incidents almost every day regarding OneDrive for Business sharing policies. Event description is: Change sharing policy: OneDrive Site Collection <b>https://xxxx-my.sharepoint.com/personal/user_domain_fi</b>; Parameters: property <b>Share Using Anonymous Links</b> <b>True</b>, property <b>Share With Guests</b>, property <b>ShareUsingAnonymousLinks</b> <b>From False To True</b>, property <b>ShareUsingAnonymousLinks - New Value</b> <b>True</b> Anonymous links are not allowed and when checking users onedrive site collection settings after alert it is still not allowed. Are these only false positives? Matched policy is Administrative activity from a non-corporate IP address and Alert Product is Microsoft Defender for Cloud Apps ~ Jukka ~"Open Wi-Fi Connection on one endpoint" - network name is "hidden for privacy"?
Background: We have Defender for Endpoint, and Intune installed on our corporate Android devices. I'm not sure what changed recently but we are now getting tons of alerts everyday forOpen Wi-Fi Connection on one endpoint. When I go in to investigate further every alert says: Device ID : <<unique ID>> connected to an open Wi-Fi network : hidden for privacy Is there any way to see what the actual network connected to is, to determine if this is a risk or if it is just needs user education?
XDR Unified RBAC deadline
Has Microsoft set a date for when the Unified RBAC permission model will become mandatory? All the documents I've read indicate that it's voluntary right now. Eventually it will become the default. Permissions Management: Defender XDR's RBAC Walkthrough for Microsoft Defender for Office 365 | Microsoft Community Hub Chuck
