You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: ATPDocs/advanced-settings.md
+11-8Lines changed: 11 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,7 @@
1
1
---
2
2
title: Adjust alert thresholds | Microsoft Defender for Identity
3
3
description: Learn how to configure the number of Microsoft Defender for Identity alerts triggered of specific alert types by adjusting alert thresholds.
4
-
ms.date: 02/11/2024
4
+
ms.date: 08/03/2025
5
5
ms.topic: how-to
6
6
#CustomerIntent: As a Microsoft Defender for Identity customer, I want to reduce the number of false positives by adjusting thresholds for specific alerts.
7
7
ms.reviewer: rlitinsky
@@ -15,7 +15,7 @@ Some Defender for Identity alerts rely on *learning periods* to build a profile
15
15
16
16
Use the **Adjust alert thresholds** page to customize the threshold level for specific alerts to influence their alert volume. For example, if you're running comprehensive testing, you might want to lower alert thresholds to trigger as many alerts as possible.
17
17
18
-
Alerts are always triggered immediately if the **Recommended test mode** option is selected, or if a threshold level is set to **Medium** or **Low**, regardless of whether the alert's learning period has already completed.
18
+
Alerts are triggered immediately if the **Recommended test mode** option is selected, or if a threshold level is set to **Medium** or **Low**, regardless of whether the alert's learning period has already completed.
19
19
20
20
> [!NOTE]
21
21
> The **Adjust alert thresholds** page was previously named **Advanced settings**. For details about this transition and how any previous settings were retained, see our [What's New announcement](whats-new.md#enhanced-user-experience-for-adjusting-alert-thresholds-preview).
@@ -46,24 +46,27 @@ For example, if you have NAT or VPN, we recommend that you consider any changes
46
46
When you select **Medium** or **Low**, details are bolded in the **Information** column to help you understand how the change affects the alert behavior.
47
47
48
48
1. Select **Apply changes** to save changes.
49
+
1. Select **Revert to default** and then **Apply changes** to reset all alerts to the default threshold (**High**). Reverting to default is irreversible and any changes made to your threshold levels are lost.
49
50
50
-
Select **Revert to default** and then **Apply changes** to reset all alerts to the default threshold (**High**). Reverting to default is irreversible and any changes made to your threshold levels are lost.
51
-
52
-
## Switch to test mode
51
+
## Switch to Recommended test mode
53
52
54
53
The **Recommended test mode** option is designed to help you understand all Defender for Identity alerts, including some related to legitimate traffic and activities so that you can thoroughly evaluate Defender for Identity as efficiently as possible.
55
54
56
55
If you recently deployed Defender for Identity and want to test it, select the **Recommended test mode** option to switch all alert thresholds to **Low** and increase the number of alerts triggered.
57
56
58
-
Threshold levels are read-only when the **Recommended test mode** option is selected. When you're finished testing, toggle the **Recommended test mode** option back off to return to your previous settings.
57
+
Threshold levels are read-only when the **Recommended test mode** option is selected.
58
+
59
+
> [!NOTE]
60
+
> Test mode is time-limited to a maximum of 60 days.
61
+
> When turning on Recommended test mode, you must specify an end time. The selected end time is displayed next to the toggle for as long as test mode is enabled.
59
62
60
-
Select **Apply changes** to save changes.
63
+
When you're finished testing, toggle the Recommended test mode option back off to return to your previous settings. Select **Apply changes** to save changes.
61
64
62
65
## Supported detections for threshold configurations
63
66
64
67
The following table describes the types of detections that support adjustments for threshold levels, including the effects of **Medium** and **Low** thresholds.
65
68
66
-
Cells marked with N/A indicate that the threshold level is not supported for the detection
69
+
Cells marked with N/A indicate that the threshold level isn't supported for the detection.
title: 'Security Assessment: Remove Discoverable Passwords in Active Directory Account Attributes (Preview)'
3
+
description: Learn how to identify and address discoverable passwords in Active Directory account attributes to mitigate security risks and improve your organization's security posture.
4
+
ms.date: 08/12/2025
5
+
ms.topic: how-to
6
+
---
7
+
8
+
# Security Assessment: Remove discoverable passwords in Active Directory account attributes (Preview)
9
+
10
+
11
+
## Why do discoverable passwords in Active Directory account attributes pose a risk?
12
+
13
+
Certain free-text attributes are often overlooked during hardening but are readable by any authenticated user in the domain. When credentials or clues are mistakenly stored in these attributes, attackers can abuse them to move laterally across the environment or escalate privileges.
14
+
15
+
Attackers seek low-friction paths to expand access. Exposed passwords in these attributes represent an easy win because:
16
+
17
+
- The attributes aren't access-restricted.
18
+
19
+
- They aren't monitored by default.
20
+
21
+
- They provide context attackers can exploit for lateral movement and privilege escalation.
22
+
23
+
Removing exposed credentials from these attributes reduces the risk of identity compromise and strengthens your organization’s security posture.
24
+
25
+
26
+
## How does Microsoft Defender for Identity detect discoverable passwords?
27
+
28
+
> [!NOTE]
29
+
> Findings can include false positives. Always validate the results before taking action.
30
+
31
+
Microsoft Defender for Identity detects potential credential exposure in Active Directory by analyzing commonly used free-text attributes. This includes looking for common password formats, hints, `'description'`, `'info'`, and `'adminComment'` fields, and other contextual clues that might suggest the presence of credential misuse.
32
+
This recommendation uses GenAI-powered analysis of Active directory attributes to detect:
33
+
34
+
- Plaintext passwords or variations. For example, '`Password=Summer2025!'`
35
+
36
+
- Credential patterns, reset hints, or sensitive account information.
37
+
38
+
- Other indicators suggesting operational misuse of directory fields.
39
+
40
+
Detected matches are surfaced in **Secure Score** and the **Security Assessment report** for review and remediation.
41
+
42
+
43
+
## Remediation steps
44
+
45
+
To address this security assessment, follow these steps:
46
+
47
+
1. Review the recommended action at [https://security.microsoft.com/securescore?viewid=actions](https://security.microsoft.com/securescore?viewid=actions) for Remove discoverable passwords in Active Directory account attributes.
48
+
1. Review the exposed entries in the security report. Identify any field content that includes:
49
+
50
+
- Cleartext passwords
51
+
52
+
- Reset instructions or credential clues
53
+
54
+
- Sensitive business or system information
55
+
56
+
1. Remove sensitive information from the listed attribute fields using standard directory management tools (for example, PowerShell or ADSI Edit).
57
+
1. Fully remove the sensitive information. Don’t just mask the value. Partial obfuscation (for example, P@ssw***) can still offer useful clues to attackers.
58
+
59
+
> [!NOTE]
60
+
> Assessments are updated in near real time. Scores and statuses are updated every 24 hours. The list of impacted entities is updated within a few minutes of you implementing the recommendations. The status might take time until it's marked as **Completed**.
61
+
62
+
## Related articles
63
+
64
+
-[Learn more about Microsoft Secure Score](/defender-xdr/microsoft-secure-score)
title: 'Security Assessment: Remove Inactive Service Account (Preview)'
3
+
description: Learn how to identify and address inactive Active Directory service accounts to mitigate security risks and improve your organization's security posture.
4
+
ms.date: 08/17/2025
5
+
ms.topic: how-to
6
+
#customer intent: As a security administrator, I want to improve security posture in my organization by removing inactive service accounts
7
+
---
8
+
9
+
# Security Assessment: Remove Inactive Service Accounts (Preview)
10
+
11
+
This recommendation lists Active Directory service accounts detected as inactive (stale) within the past 180 days.
12
+
13
+
## Why do inactive service accounts pose a risk?
14
+
15
+
Unused service accounts create significant security risks, as some of them can carry elevated privileges. If attackers gain access, the result can be substantial damage. Dormant service accounts might retain high or legacy permissions. When compromised, they provide attackers with discreet entry points into critical systems, granting far more access than a standard user account.
16
+
17
+
This exposure creates several risks:
18
+
19
+
- Unauthorized access to sensitive applications and data.
20
+
21
+
- Lateral movement across the network without detection.
22
+
23
+
24
+
## How do I use this security assessment to improve my organizational security posture?
25
+
26
+
To use this security assessment effectively, follow these steps:
27
+
28
+
1. Review the recommended action at [https://security.microsoft.com/securescore?viewid=actions ](https://security.microsoft.com/securescore?viewid=actions ) for Remove inactive service account.
29
+
1. Review the list of exposed entities to discover which of your service account is inactive.
30
+
31
+
:::image type="content" source="media/okta-integration/remove-inactive-service-accounts.png" alt-text="Screenshot that shows the recommendation action to remove inactive service accounts." lightbox="media/okta-integration/remove-inactive-service-accounts.png":::
32
+
33
+
1. Take appropriate actions on those entities by removing the service account. For example:
34
+
35
+
-**Disable the account:** Prevent any usage by disabling the account identified as exposed.
36
+
37
+
-**Monitor for impact:** Wait several weeks and monitor for operational issues, such as service disruptions or errors.
38
+
39
+
-**Delete the account:** If no issues are observed, delete the account and fully remove its access.
40
+
41
+
> [!NOTE]
42
+
> Assessments are updated in near real time, and scores and statuses are updated every 24 hours. The list of impacted entities is updated within a few minutes of your implementing the recommendations. The status might take time until it's marked as **Completed**.
43
+
44
+
## Related articles
45
+
46
+
-[Learn more about Microsoft Secure Score](/defender-xdr/microsoft-secure-score)
0 commit comments