Anomalous Token alert of Defender

Suraj Rimal 0 Reputation points
2024-02-27T23:38:07.87+00:00

Hi all, We used to receive an Anomalous token alert on Defender, and it stopped all of a sudden. Unable to see any policy associated with it. Please help to figure it out.

Microsoft Defender for Cloud
Microsoft Defender for Cloud
An Azure service that provides threat protection for workloads running in Azure, on-premises, and in other clouds. Previously known as Azure Security Center and Azure Defender.
1,250 questions
Microsoft Defender for Cloud Apps
Microsoft Defender for Cloud Apps
A Microsoft cloud access security broker that enables customers to control the access and use of software as a service apps in their organization.
118 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
20,353 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. JamesTran-MSFT 36,531 Reputation points Microsoft Employee
    2024-02-28T19:47:49.23+00:00

    @Suraj Rimal

    Thank you for your post!

    When it comes to the policies pertaining to an anomalous token, you should be able to find these within the following locations:

    1. The Policy management section in your Microsoft 365 Defender portal.
      • You can see the anomaly detection policies in the Microsoft Defender Portal, by going to Cloud Apps -> Policies -> Policy management. Then choosing the Anomaly detection policy for the policy type.
      User's image
    2. Microsoft Entra ID Protection - Risk detections in Microsoft Entra ID Protection include any identified suspicious actions related to user accounts in the directory. For more info: Sign-in risk detections.
      • You can find your MS Entra ID Protection policies from your MS Entra ID tenant -> Security -> Identity Protection.
      User's image
    3. Conditional Access Policy - Since the legacy risk policies (user risk policy or sign-in risk policy) configured in Microsoft Entra ID Protection will be retired on October 1, 2026. There's a chance your organization has already migrated to the Sign-in risk-based Conditional Access policy.
      • You can find your Conditional Access Policies within your MS Entra ID tenant -> Security -> Conditional Access.
      Screenshot of a sign-in risk-based Conditional Access policy.

    Additional Links:

    I hope this helps!

    If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

    If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

    0 comments