Unusual volume file deletion alert office 365 not showing in cloud app

[Wesley Baeyens]

Hey guys,

I just have a quick question, we receive several mails from o365 about a user triggering the unusual volume of file deletion, however we don't see any warning in cloudapp security. Even tough we linked the app connector, and we actually see in the activity log the file deletions.  So why is cloudapp not giving any error on this, or i still need to do anything else? 

thanks already.

greetings

[#2]

I dont have an answer but didn't even know this feature was available.

Keen to see if can be done

[#3]

@Wesley Baeyens the detections in O365 and Cloud App Security are not the same and do not have the same logic.

The one in MCAS will take into account more criterias, like the location that was used by the user to perform the downloads.

Best regards

[#4]

@Sebastien Molendijk 

We have the same situation. Is there any documentation about the logic of the mentioned alerts? Do you have any guidance for the coexistence of S&C alert policies and MCAS anomaly detections? Should we disable the S&C Alerts because the MCAS policies are more accurate?

Thanks for your help!