Security Policy Errors

How to Find Who Updated Cloud App Security Policies in Microsoft 365

WPS Content Manager Oct 10, 2026 868 views

Question details

Users need to identify who modified or disabled built-in Microsoft Cloud App Security policies when no administrative changes appear in the activity logs.

How to Find Who Updated Cloud App Security Policies

Product: Microsoft Cloud App Security
Device & OS: not provided
Scenario: Administrators notice that built-in security policies display unexpected update dates or are disabled, and need to trace the source of these modifications.
Observed behavior: Built-in policies show recent update dates or become disabled, but Microsoft 365 Defender audit and activity logs do not show any corresponding admin actions.

Before you start

Ensure you are signed in with Global Administrator or Security Administrator privileges to access the Microsoft 365 Defender portal and audit logs.

Solution 1Recommended

Review Audit Logs and Identify Microsoft System Updates

Cross-reference administrator activity logs with system updates to determine if Microsoft automatically updated the built-in policies.

Because some Microsoft Cloud App Security policies are built-in, Microsoft may occasionally deploy automated backend updates to improve threat detection or compliance. These system-level updates can alter the modification date or disable obsolete policies without generating a standard administrator audit log.

Access the Microsoft 365 Defender Portal

Navigate to Audit Logs

Go to the 'Audit' section from the left navigation menu to search for all policy modification activities within the relevant timeframe.

Review the Activity Log

Open the specific Cloud App Security activity logs to filter for changes made to the policies in question. Check if any internal user accounts are associated with the change.

Attribute to Built-in Updates

If the audit and activity logs show no internal administrator actions but the built-in policy was still updated, attribute the change to a Microsoft automated system update.

Contact Microsoft Support

If you suspect unauthorized access or need concrete verification of the system update, open a support ticket with Microsoft Support for further backend investigation.

Review Audit Logs and Identify Microsoft System Updates

Built-in Policy Behavior: Microsoft frequently updates built-in policy templates. Custom policies created by administrators are generally not modified by these automated system updates.

Free Microsoft Office alternative

Looking for a Secure and Lightweight Office Suite?

While you manage your Microsoft 365 administrative and security settings, consider WPS Office as a free, lightweight, and highly compatible alternative for your local document processing. Enjoy seamless migration with a familiar interface, completely free of complex enterprise administrative overhead.

1. Download WPS Office: Visit the official WPS website to download the free installation package for your operating system.
2. Install the Application: Run the installer and follow the on-screen prompts to complete the lightweight installation process.
3. Open Your Documents: Launch WPS Office and directly open your existing Microsoft Office files with perfect formatting compatibility.

Fully compatible with Microsoft Office formats, including Word, Excel, and PowerPoint files.Lightweight architecture ensures fast installation and smooth local performance.Familiar user interface requires zero learning curve for a seamless migration.Built-in robust local document encryption features to keep your files secure.

microsoft office alternative - wps office

Frequently Asked Questions

Why do built-in security policies change without admin action?

Microsoft periodically pushes system updates to built-in security policy templates to improve threat detection and adapt to new compliance standards. These backend updates alter the modification date without leaving an admin-triggered audit log.

Where can I view Cloud App Security activity logs?

Activity logs can be accessed through the Microsoft 365 Defender portal. Navigate to the Cloud Apps section and select the Activity log to view user and system activities.

What permissions are required to view security audit logs?

To view audit logs and security policies, you must be assigned a role such as Global Administrator, Security Administrator, or Compliance Administrator in Microsoft Entra ID.

Microsoft Office Security Issues