Unusual external user file activity - whitelist users or domains

%3CLINGO-SUB%20id%3D%22lingo-sub-2467370%22%20slang%3D%22en-US%22%3EUnusual%20external%20user%20file%20activity%20-%20whitelist%20users%20or%20domains%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2467370%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20have%20some%20external%20users%20that%20we%20would%20like%20to%20exclude%20from%20the%26nbsp%3BUnusual%20external%20user%20file%20activity%20alert.%26nbsp%3B%20We%20understand%20that%20we%20could%20create%20a%20custom%20alert%20policy%20and%20add%20the%20user%20as%20condition.%26nbsp%3B%20However%20we%20are%20not%20sure%20if%20we%20can%20add%20the%20guest%20user%20account%20here%20and%20or%20if%20we%20could%20add%20the%20guest%20user%20domain%20as%20they%20are%20in%20the%20format%20of%26nbsp%3B%3CEM%3Eextrenaldomain%3C%2FEM%3E%23ext%23%40kordiagroup.onmicrosoft.com%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2467370%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EMicrosoft%20Defender%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EUnusual%20external%20user%20file%20activity%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3Ewhitelist%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Occasional Visitor

Hi,

 

We have some external users that we would like to exclude from the Unusual external user file activity alert.  We understand that we could create a custom alert policy and add the user as condition.  However we are not sure if we can add the guest user account here and or if we could add the guest user domain as they are in the format of extrenaldomain#ext#@kordiagroup.onmicrosoft.com

0 Replies