Forum Discussion
Defender for Identity Learning Period
There is no documentation around Learning Period. Most of articles I've skimmed through mentions toggle this and that, but there is no clear documentation on how we can verify if learning period is o...
Also, what's the Microsoft's recommended Alert Threshold for alerts?
logger2115 I recommend that you start by using the default settings, which Microsoft has optimized for most environments. If you notice too many false positives or that the system is not generating enough alerts, you can change the thresholds, but do so carefully. Monitor your alerts regularly: over time you will understand how the thresholds work in your context. When you decide to make changes, try to maintain a balance between safety and the number of alerts you receive.
