In OCAS, MS have configured a bunch of alerts like "impossible travel".
99% of the time these fire, they are false positives, and results in many alert email and time spent. Can they be hardened?
Ex. We have users in AU and US. Our tenant is in AU. When a user in the US accesses a file in SP, it triggers impossible travel, because the Onedrive/Sharepoint storage is in AU, but the are in US..
Ex. A user accesses a mailbox legitimately that is stored in another country, i get email alerts..
