You have a Microsoft 365 E5 subscription and use Microsoft Defender for Cloud Apps. You need to ensure that when a user-based alert is triggered in Defender for Cloud Apps, the user is marked as…

Question

Options

• Aa Microsoft Power Automate playbook
• Ba user tag
• Ca custom detection rule
• Da block script
• Ean automated remediation level

• A
  78% (21)
• B
  4% (1)
• C
  7% (2)
• D
  11% (3)

Explanation

Two complete solutions exist for automating the response of marking a user as compromised in Microsoft Defender for Cloud Apps. Option A (Microsoft Power Automate playbook): Defender for Cloud Apps integrates natively with Power Automate. You can configure a playbook to trigger automatically when a user-based alert fires, and the playbook can call the Defender for Cloud Apps API to mark the user as compromised. Option E (Automated remediation level): Defender for Cloud Apps includes built-in automated remediation levels under its anomaly detection policies. When configured, these can automatically mark a user as compromised in response to qualifying alerts without any manual intervention. Why the others are wrong: A user tag (B) is used for categorizing users (e.g., 'VIP'), not for triggering automated actions. A custom detection rule (C) generates alerts but does not itself remediate. A block script (D) is used in the API connector to block specific IPs or actions, not to mark users as compromised.

No community discussion yet for this question.