Forum Discussion

StuartH .'s avatar
StuartH .
Brass Contributor
Jan 26, 2018

Sensitive groups

Has anyone managed to get anything meaningful from Sensitive Groups ?  I thought the intent was to "monitor" those groups for membership changes.  I have pushed and pulled users in and out of groups ...
EliOfek's avatar
EliOfek
Icon for Microsoft rankMicrosoft
Jan 27, 2018

This detector needs a  learning period before it is active.

How long is the system deployed with this version?

 

StuartH .'s avatar
StuartH .
Brass Contributor
Jan 27, 2018

At least 8 weeks. What actually is the detector learning ?  "Normal" modifications by expected admins or other sensitive users ?

  • EliOfek's avatar
    EliOfek
    Icon for Microsoft rankMicrosoft
    Jan 28, 2018

    Generally yes,

    wait for 2-3 more weeks, then to invoke the alert, try to modify a sensitive group using an account that does not normally do it...

Resources