Re: Defender for Identity Learning Period

logger2115 I recommend that you start by using the default settings, which Microsoft has optimized for most environments. If you notice too many false positives or that the system is not generating enough alerts, you can change the thresholds, but do so carefully. Monitor your alerts regularly: over time you will understand how the thresholds work in your context. When you decide to make changes, try to maintain a balance between safety and the number of alerts you receive.