Microsoft Secure Tech Accelerator
Apr 03 2024, 07:00 AM - 11:00 AM (PDT)
Microsoft Tech Community

O365 CAS - is there a way to duplicate or use as a template an Impossible Travel policy?

Copper Contributor

Is there a way to duplicate an Impossible Travel policy, or use it as a template (anomaly based policies are not listed as options for a template for me)?
The goal is to have two separate policies: one that will record only successful impossible travel sing ins, and second one that will record failed impossible travel sing ins. This way an admin could configure related alerting, triage, and governance properly for each of these policies.
(I'm aware that Multiple Failed Login Attempts policy could be used and tuned to alert for the failed sing ins, but this won't utilize the anomaly based capability given with this Impossible Travel policy.)
So, I'm just curios if anybody had luck with a similar task?
Thank you! :)

1 Reply

@AnastasiaW - I agree, I've had many of those policies I'd like to copy and add a condition to and make "my own"... great question.