How to Retrieve Microsoft 365 Defender Threat Detection Policy Details
Question details
The user needs to retrieve historical information about a ransomware activity policy in Microsoft 365 Defender to identify the last user who modified it.
- Product
- Microsoft 365 Defender
- Device & OS
- not provided
- Scenario
- Auditing security policy configurations to track changes made to a ransomware activity policy.
- Observed behavior
- Standard PowerShell commands like Get-MpThreatDetection and Get-MpPreference fail to provide policy edit history or identify the modifying user, instead only showing endpoint threat detections.
Ensure you have the appropriate administrative permissions (such as Global Administrator or Security Administrator) to access the Microsoft Purview compliance portal and view unified audit logs.
Review Microsoft 365 Unified Audit Logs
Use the unified audit logs in the Microsoft Purview compliance portal to track administrative changes made to your Defender policies.
Commands like Get-MpThreatDetection are primarily designed for endpoint threat detections and do not capture the historical modification data of cloud-based Microsoft 365 Defender policies. To find the last editor, you must check the centralized audit logs.
Navigate to the Microsoft Purview compliance portal and log in with your administrator credentials.
From the left-hand navigation menu, select 'Audit' to access the unified audit log search interface.
Set the specific Date and Time range covering the period when you suspect the ransomware policy was modified.
In the 'Activities' dropdown, search for and select the specific activities related to Microsoft Defender policy configurations or updates.
Run the search and review the results. Locate the specific ransomware policy update event and check the 'User' column to see who last modified it.
Looking for a secure and lightweight office suite?
Managing enterprise security like Microsoft 365 Defender requires specialized tools, but everyday document creation shouldn't be complex or expensive. WPS Office is a free, lightweight, and highly compatible alternative to Microsoft Office, offering a familiar interface for all your document, spreadsheet, and presentation needs with zero learning curve.
- 1. Download WPS Office: Visit the official WPS website and download the free installation package for your operating system.
- 2. Install the Software: Run the downloaded installer and follow the simple on-screen instructions to complete the setup.
- 3. Open Your Documents: Launch WPS Office and seamlessly open your existing Microsoft Office files without worrying about formatting issues.
Frequently Asked Questions
Why doesn't Get-MpThreatDetection show who changed the policy?
The Get-MpThreatDetection PowerShell command is designed to query active threat detections on local Windows endpoints. It is not built to audit cloud-based administrative changes to Microsoft 365 Defender policies.
Can I use Get-MpPreference to find the policy editor?
No. Get-MpPreference retrieves the current configuration of Windows Defender Antivirus on a specific endpoint, but it does not store or display the historical audit trail or the identity of the user who modified those preferences in the cloud portal.
Where else can I find logs if the unified audit log is empty?
If the unified audit log does not contain the required data, you can check specific Defender audit records via the Microsoft 365 Defender portal, or consult Azure Active Directory sign-in and audit logs for administrative access during the suspected timeframe.
