Forum Discussion
Multiple Policies Disabled in MCAS portal since 24th Jul'23
Adding to Greg's note, there are two main cases where policies could have been disabled:
1. a one time operation: as we introduced the concept of behavior back in end of May, we disabled a number of built in policy alerts. The detections still exist and are now risky "behaviors", as part of the incidents in the Microsoft 365 Defender Portal. In your case, this does not fit with the dates you are mentioning below.
2. more commonly, should you delete entities that are referenced in a policy, the policy will be disabled. For instance if a policy applies specifically to a group named "Germany users", and that group is deleted, all policies referencing that group will be disabled.
Does this match your case?
MicrosoftAdding to Greg's note, there are two main cases where policies could have been disabled:
1. a one time operation: as we introduced the concept of behavior back in end of May, we disabled a number of built in policy alerts. The detections still exist and are now risky "behaviors", as part of the incidents in the Microsoft 365 Defender Portal. In your case, this does not fit with the dates you are mentioning below.
2. more commonly, should you delete entities that are referenced in a policy, the policy will be disabled. For instance if a policy applies specifically to a group named "Germany users", and that group is deleted, all policies referencing that group will be disabled.
Does this match your case?
