Forum Discussion
arifvase
May 23, 2024Copper Contributor
Incidents and Alerts blades missing in Defender portal
Hi,
We recently found out that the incidents and alerts blades have disappeared from our Defender portal. This is true for both Global Admin and Security Administrator roles. We use A5 licenses in our tenant. Not sure what happened. Microsoft Unified support has not been very helpful in even replying to our query. Can someone please point us in the right direction. We don't know what has happened.
Thanks in advance,
Hi ahmedamer ,
have you or someone on the team perhaps turned on the Defender for Endpoint deception features?
You can check the setting for Deception by going to your XDR dashboard > Settings > Endpoints > Advanced features and scroll to find the setting for “Deception” towards the bottom of the features list.
if it’s on, you can confirm that the user you’re seeing is apart of the deception identities by scrolling a bit more on the endpoints menu for the “Deception rules” tab under the Rules header. There may just be one Default rule there. Click it and you should see a list of deception identities.
see more here: Configure the deception capability in Microsoft Defender XDR
Best,
Dylan
1 Reply
Sort By
- arifvaseCopper Contributor
The issue was a "classic" conditional access policy targeting the Windows Defender ATP service that was blocking the Alerts and Incidents blades. Removing the classic policy re-enabled alerts and incidents.