You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: ATPDocs/change-password-krbtgt-account.md
+3-1Lines changed: 3 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -29,7 +29,9 @@ If the KRBTGT account's password is compromised, an attacker can use its hash to
29
29
1. Take appropriate action on those accounts by resetting their password **twice** to invalidate the Golden Ticket attack.
30
30
31
31
> [!NOTE]
32
-
> The krbtgt Kerberos account in all Active Directory domains supports key storage in all Kerberos Key Distribution Centers (KDC). To renew the Kerberos keys for TGT encryption, periodically change the krbtgt account password. It is recommended to use the [Microsoft-provided script.](https://github.com/microsoft/New-KrbtgtKeys.ps1)
32
+
> The krbtgt Kerberos account in all Active Directory domains supports key storage in all Kerberos Key Distribution Centers (KDC). To renew the Kerberos keys for TGT encryption, periodically change the krbtgt account password. It is recommended to use the [Microsoft-provided script.](https://github.com/microsoft/New-KrbtgtKeys.ps1)
33
+
> When resetting the password twice, wait at least 10 hours between resets to avoid Kerberos authentication issues. This wait time is enforced by the script and aligns with best practices.
34
+
33
35
### Next steps
34
36
35
37
[Learn more about Microsoft Secure Score](/microsoft-365/security/defender/microsoft-secure-score)
Copy file name to clipboardExpand all lines: ATPDocs/whats-new.md
+29-5Lines changed: 29 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -25,22 +25,46 @@ For updates about versions and features released six months ago or earlier, see
25
25
26
26
## September 2025
27
27
28
+
### Updates to multiple detections to reduce noise and improve alert accuracy
29
+
30
+
Several Defender for Identity detections are being updated to reduce noise and improve accuracy, making alerts more reliable and actionable. As the rollout continues, you may see a decrease in the number of alerts raised.
31
+
32
+
The improvements will gradually take effect across the following detections:
- Suspicious modification of Resource Based Constrained Delegation by a machine account
49
+
50
+
- Remote code execution attempt
51
+
28
52
### Unified connectors is now available for Okta Single Sign-On connectors (Preview)
29
53
30
54
Microsoft Defender for Identity supports the [Unified connectors](/azure/sentinel/unified-connector) experience, starting with the Okta Single Sign-On connector. This enables Defender for Identity to collect Okta system logs once and share them across supported Microsoft security products, reducing API usage and improving connector efficiency.
31
55
32
-
For more information see: [Connect Okta to Microsoft Defender for Identity (Preview)](okta-integration.md)
56
+
For more information, see: [Connect Okta to Microsoft Defender for Identity (Preview)](okta-integration.md)
33
57
34
58
35
59
## August 2025
36
60
37
61
### Microsoft Entra ID risk level is now available in near real time in Microsoft Defender for Identity (Preview)
38
62
39
-
Entra ID risk level is now available on the Identity Inventory assets page, the identity details page, and in the IdentityInfo table in Advanced Hunting, and includes the Entra ID risk score. SOC analysts can use this data to correlate risky users with sensitive or highly privileged users, create custom detections based on current or historical user risk, and improve investigation context.
63
+
Microsoft Entra ID risk level is now available on the Identity Inventory assets page, the identity details page, and in the IdentityInfo table in Advanced Hunting, and includes the Microsoft Entra ID risk score. SOC analysts can use this data to correlate risky users with sensitive or highly privileged users, create custom detections based on current or historical user risk, and improve investigation context.
40
64
41
-
Previously, Defender for Identity tenants received Entra ID risk level in the IdentityInfo table through user and entity behavior analytics (UEBA). With this update, the Entra ID risk level is now updated in near real time through Microsoft Defender for Identity.
65
+
Previously, Defender for Identity tenants received Microsoft Entra ID risk level in the IdentityInfo table through user and entity behavior analytics (UEBA). With this update, the Microsoft Entra ID risk level is now updated in near real time through Microsoft Defender for Identity.
42
66
43
-
For UEBA tenants without a Microsoft Defender for Identity license, synchronization of Entra ID risk level to the IdentityInfo table remains unchanged.
67
+
For UEBA tenants without a Microsoft Defender for Identity license, synchronization of Microsoft Entra ID risk level to the IdentityInfo table remains unchanged.
44
68
45
69
### New security assessment: Remove stale service accounts (Preview)
46
70
@@ -478,7 +502,7 @@ Defender for Identity added the new **Edit insecure ADCS certificate enrollment
478
502
479
503
Active Directory Certificate Services (AD CS) supports certificate enrollment through various methods and protocols, including enrollment via HTTP using the Certificate Enrollment Service (CES) or the Web Enrollment interface (Certsrv). Insecure configurations of the CES or Certsrv IIS endpoints might create vulnerabilities to relay attacks (ESC8).
480
504
481
-
The new **Edit insecure ADCS certificate enrollment IIS endpoints (ESC8)** recommendation is added to other AD CS-related recommendations recently released. Together, these assessments offer security posture reports that surface security issues and severe misconfigurations that post risks to the entire organization, together with related detections.
505
+
The new **Edit insecure ADCS certificate enrollment IIS endpoints (ESC8)** recommendation is added to other AD CS-related recommendations recently released. Together, these assessments offer security posture reports that surface security issues and severe misconfigurations that pose risks to the entire organization, together with related detections.
Copy file name to clipboardExpand all lines: CloudAppSecurityDocs/app-governance-app-policies-get-started.md
+11-9Lines changed: 11 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,8 +1,9 @@
1
1
---
2
2
title: Get started with app governance policies | Microsoft Defender for Cloud Apps
3
-
ms.date: 05/28/2023
3
+
ms.date: 08/31/2025
4
4
ms.topic: how-to
5
5
description: Get started learning about app governance policies with Microsoft Defender for Cloud Apps in Microsoft Defender XDR
6
+
ms.reviewer: shragar456
6
7
---
7
8
8
9
# Get started with app policies
@@ -23,22 +24,21 @@ To see your list of current app policies, go to the **Microsoft Defender XDR > A
23
24
24
25
For example:
25
26
26
-
27
+
:::image type="content" source="media/app-governance-app-policies-get-started/app-governance-app-policies.png" alt-text="Screenshot that shows the app governance app polcies." lightbox="media/app-governance-app-policies-get-started/app-governance-app-policies.png":::
27
28
28
29
> [!NOTE]
29
30
> Built-in threat detection policies aren't listed on the **Policies** tab. For more information, see [Investigate threat detection alerts](app-governance-anomaly-detection-alerts.md).
30
31
>
31
32
32
33
## What’s available on the app policies dashboard
33
34
34
-
The **App governance** > **Policies** tab shows the number of active, inactive, and audit mode policies, and the following information for each policy:
35
+
The **App governance** > **Policies** tab shows the number of activeand disabled policies, and the following information for each policy:
35
36
36
37
-**Policy name**
37
38
-**Status**
38
39
39
40
-**Active**: All policy evaluation and actions are active.
40
-
-**Inactive**: All policy evaluation and actions are disabled.
41
-
-**Audit mode**: Policy evaluation is active (alerts will trigger) but policy actions are disabled.
41
+
-**Disabled**: All policy evaluation and actions are disabled.
42
42
43
43
-**Severity**: Severity level set on any alerts triggered because of this policy being evaluated as true, which is part of the configuration of the policy.
44
44
-**Active alerts**: Number of alerts generated by the policy that have an **In Progress** or **New** status.
@@ -74,22 +74,24 @@ You can also:
74
74
75
75
1. Select **Edit**.
76
76
77
-
While you can't change the name of the policy once created, but you can change the description and policy severity as needed. When you're done, select **Next**.
77
+
While you can't change the name of the policy once created, you can change the description and policy severity as needed. When you're done, select **Next**.
78
78
79
79
1. Choose whether you want to continue with the existing policy settings or customize them. Select **No, I'll customize the policy** to make changes, and then select **Next**.
80
80
81
-
1. Choose whether this policy applies to all apps, specific apps, or all apps except the apps you select. Select **Choose apps** to select which apps to apply the policy to, and then select **Next**.
81
+
1. Choose whether this policy applies to all apps, specific apps, or all apps except the apps you select.
82
+
83
+
1. Select **Choose apps** to select which apps to apply the policy to, and then select **Next**.
82
84
83
85
1. Choose whether to modify the existing conditions of the policy.
84
86
85
87
- If you choose to modify the conditions, select **Edit or modify existing conditions for the policy** and choose which policy conditions to apply.
86
88
- Otherwise, select **Use existing conditions of the policy**.
87
89
88
-
When you're done, select **Next**.
90
+
1. When you're done, select **Next**.
89
91
90
92
1. Choose whether to disable the app if it triggers the policy conditions and then select **Next**.
91
93
92
-
1. Set the policy status to **Audit** mode, **Active**, or **Inactive**, as needed, and then select **Next**.
94
+
1. Set the policy status to **Active**, or **Disabled**, as needed, and then select **Next**.
93
95
94
96
1. Review your setting choices for the policy and if everything is the way you want it, select **Submit**.
Copy file name to clipboardExpand all lines: CloudAppSecurityDocs/app-governance-app-policies-manage.md
+14-33Lines changed: 14 additions & 33 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,8 +1,9 @@
1
1
---
2
2
title: Manage app policies
3
-
ms.date: 05/21/2023
3
+
ms.date: 09/08/2025
4
4
ms.topic: how-to
5
5
description: Manage your app governance policies.
6
+
ms.reviewer: shragar456
6
7
---
7
8
8
9
# Manage app policies
@@ -12,55 +13,35 @@ Use app governance to manage OAuth policies for Microsoft 365, Google Workspace,
12
13
You might need to manage your app policies as follows to keep up-to-date with your organization's apps, respond to new app-based attacks, and for ongoing changes to your app compliance needs:
13
14
14
15
- Create new policies targeted at new apps
15
-
- Change the status of an existing policy (active, inactive, audit mode)
16
+
- Change the status of an existing policy (active or disable)
16
17
- Change the conditions of an existing policy
17
18
- Change the actions of an existing policy for auto-remediation of alerts
## Manage OAuth app policies for Microsoft Entra ID
22
-
23
-
Here's an example of a process for managing an existing policy for Microsoft Entra apps:
24
-
25
-
1. Edit the policy:
26
-
27
-
- Change the settings of the policy.
28
-
- If needed, change the status to **Audit mode** for testing.
29
-
30
-
1. Check for expected behavior, such as alerts generated.
31
-
1. If the behavior isn't expected, go back to step 1.
32
-
1. If the behavior is expected, edit the policy and change its status to active (if needed).
33
-
34
-
For example:
35
-
36
-
:::image type="content" source="media/app-governance/mapg-manage-policy-process.png" alt-text="Diagram of the manage app policy workflow." lightbox="media/app-governance/mapg-manage-policy-process.png" border="false":::
21
+
## Editing an app policy configuration
37
22
38
-
> [!NOTE]
39
-
> Following the change in the **Activity type** filter, policies with the previous filter will have a "LEGACY" label attached to the filter and if the policies are edited or deleted the filter can't be restored.
23
+
To change the configuration of a user defined app policy:
40
24
41
-
## Editing an app policy configuration
25
+
1. Select the policy in the policy list, and then select **Edit** on the app policy pane.
42
26
43
-
To change the configuration of an existing app policy:
27
+
1. In the **Edit policy** page, you can make the following changes:
44
28
45
-
- Select the policy in the policy list, and then select **Edit** on the app policy pane.
46
-
- Select the vertical ellipses for the policy in the list, and then select **Edit**.
29
+
-**Description**: Change the description to make it easier to understand the policy's purpose.
30
+
-**Severity** : Change the severity for your app policy to low, medium, or high.
31
+
-**Policy settings**: Change the set of apps to which the policy applies. You can also choose to use the existing conditions or modify the conditions
32
+
-**Actions**: Change the autoremediation action for alerts generated by the policy.
33
+
-**Status**: Change the policy status.
47
34
48
-
For the **Edit policy** page, step through the pages and make the appropriate changes:
35
+
:::image type="content" source="media/app-governance-app-policies-manage/edit-user-defined-policy.png" alt-text="Screenshot that shows how to edit a user defined policy in the Defender portal. " lightbox="media/app-governance-app-policies-manage/edit-user-defined-policy.png":::
49
36
50
-
-**Description**: Change the description to make it easier to understand the policy's purpose.
51
-
-**Severity**
52
-
-**Policy settings**: Change the set of apps to which the policy applies. You can also choose to use the existing conditions or modify the conditions
53
-
-**Actions**: Change the autoremediation action for alerts generated by the policy.
54
-
-**Status**: Change the policy status.
55
37
56
38
## Deleting an app policy
57
39
58
40
To delete an app policy, you can:
59
41
60
42
- Select the policy in the policy list, and then select **Delete** on the app policy pane.
61
-
- Select the vertical ellipses for the policy in the list, and then select **Delete**.
62
43
63
-
An alternative to deleting an app policy is to change its status to inactive. Once inactive, the policy doesn't generate alerts. For example, rather than deleting an app policy for an app with a specific set of conditions that are useful for a future policy, rename the app policy to indicate its usefulness and set its status to inactive. You can later return to the policy and modify it for a similar app and set its status to audit mode or inactive.
44
+
An alternative to deleting an app policy is to change its status to disabled. Once disabled, the policy doesn't generate alerts. For example, rather than deleting an app policy for an app with a specific set of conditions that are useful for a future policy, rename the app policy to indicate its usefulness and set its status to disabled.
Copy file name to clipboardExpand all lines: CloudAppSecurityDocs/app-governance-detect-remediate-get-started.md
+4-2Lines changed: 4 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,8 +1,9 @@
1
1
---
2
2
title: Get started with app governance threat detection and remediation | Microsoft Defender for Cloud Apps
3
-
ms.date: 05/28/2023
3
+
ms.date: 08/31/2025
4
4
ms.topic: overview
5
5
description: Get started with app governance threat detection and remediation in Microsoft Defender XDR with Microsoft Defender for Cloud Apps.
6
+
ms.reviewer: shragar456
6
7
---
7
8
8
9
# Get started with app threat detection and remediation
@@ -13,7 +14,8 @@ To view the latest incidents associated with these alerts, go to the **App gover
13
14
14
15
For example:
15
16
16
-
:::image type="content" source="media/app-governance/mapg-cc-overview-alerts.png" alt-text="Screenshot of the App governance > Overview tab with the Latest alerts section highlighted." lightbox="media/app-governance/mapg-cc-overview-alerts.png":::
17
+
:::image type="content" source="media/app-governance/app-governance-overview.png" alt-text="Screenshot that shows the App Governance overview tab." lightbox="media/app-governance/app-governance-overview.png":::
18
+
17
19
18
20
On the **Overview** tab, the **Latest alerts** section lists the most recent alerts. You can use these recent alerts to quickly see the current app alert activity for your tenant.
0 commit comments