You need to modify the anomaly detection policy settings to meet the Cloud App Security requirements. Which policy should you modify?

The "Impossible travel" policy is a key anomaly detection policy within Microsoft Defender for Cloud Apps. It leverages User and Entity Behavior Analytics (UEBA) and machine learning to identify potential account compromises. This policy triggers an alert when activities from the same user are detected in different geographic locations within a time frame that is shorter than the time it would take to travel between those locations. Administrators frequently modify the sensitivity settings of this policy to balance security with the reduction of false positives, making it a primary candidate for modification to meet specific security requirements.

A. Activity from suspicious IP addresses: While this is a valid anomaly detection policy, it is based on static threat intelligence about IP addresses, not on a behavioral anomaly specific to the user's own activity patterns.

B. Activity from anonymous IP addresses: This is also a valid policy, but it triggers based on the source IP being a known anonymous proxy. It is less about a user's behavioral deviation and more about the nature of the connection source.

D. Risky sign-in: "Risky sign-in" is a detection and policy type primarily associated with Azure AD Identity Protection, not a native, built-in anomaly detection policy name within Microsoft Defender for Cloud Apps itself.

1. Microsoft Learn. (2023). Anomaly detection policies in Microsoft Defender for Cloud Apps. "The impossible travel policy is a behavioral anomaly detection that profiles your environment and triggers alerts when activities are detected from the same user in different locations within a time period that's shorter than the expected travel time between the two locations." This source lists "Impossible travel

" "Activity from anonymous IP addresses

" and "Activity from suspicious IP addresses" as distinct anomaly detection policies.

2. Microsoft Learn. (2023). Tune anomaly detection policies. "This article describes how to work with anomaly detection policies and fine-tune them to get better results... For example

the impossible travel alert sensitivity slider determines the level of suppression applied to the anomalous behavior." This highlights that tuning the Impossible travel policy is a key administrative task.

3. Microsoft Learn. (2023). What is risk? - Azure Active Directory Identity Protection. "Azure AD uses adaptive machine learning algorithms and heuristics to detect suspicious actions that are related to your user accounts. Each detected suspicious action is stored in a record called a risk detection... Sign-in risk represents the probability that a given authentication request isn't authorized by the identity owner." This reference confirms that "Risky sign-in" is a concept and policy within Azure AD Identity Protection

distinguishing it from Defender for Cloud Apps policies.