Microsoft Defender for Identity native alert page in Microsoft 365 Defender

[Ricky Simpson]

Hi everyone,

We posted a new blog around Defender for Identity alerting now being generally available in Microsoft 365 Defender. We posted this to the Microsoft 365 Defender blog space, so I wanted to bring attention to it here too.

Microsoft Defender for Identity native alert page in Microsoft 365 Defender - Microsoft Tech Communi...

Thanks!

Ricky

[#2]

Hi @Ricky Simpson 

Great to see the integration into M365 Security Center. 

But we have an issue with this new feature...
If we close an alert in M365 Security Center or MCAS, the alert is not closed in MDI.

The other way round works fine, if we close an alert in MDI it's closed in M365SC and MCAS.

Is it a bug or by design ?

[#3]

@DanPan Thanks for leaving your comment. 

The experience should be that if you close an alert on Microsoft 365 Defender, it should close on Defender for Identity and it should close on MCAS. If this isn't the case, please get in touch with support to see what can be done to help.  

[#4]

Thanks for replying my post.
I will open a support case.

[#5]

Thank you for sharing

[#6]

To manage MDI alerts in M365 Security Center the “Security Operator” role does not seem to be enough. You need to have "Security Administrator" role. Correct?