​I started for a company that runs primarily on an Azure and Microsoft Defender environment.  They get tons and tons of alerts for Risky User activity.  Recently I looked at their Risky Users policy and found that it was set to Who All Users, Severity All Low, High, and Critical alerts, Mitigation Block/Lockout.  So basically, the company janitor with extremely limited access along with the CEO are all dumped into the same bucket.  For this reason they get tons of these alerts with the users triggering the alerts getting locked out.  The Risky User alerts/blocks is literally crippling their productivity.  Is the best practice for this not to have users segmented and then assign different levels of the Risky User policy to them? How does one go about methodically and systematically setting up this segmentation? The company is the type that is made up of multiple smaller companies added from acquisitions.  Read More

​