Why Defender for Cloud Apps Triggers New Risky App Alerts
Question details
Users receive New Risky App alerts from Defender for Cloud Apps for applications with a risk score of 4 or lower, even when the application cannot be found on the user's local computer.
- Product
- Microsoft Defender for Cloud Apps
- Device & OS
- not provided
- Scenario
- Managing cloud app security and investigating unexpected New Risky App alerts.
- Observed behavior
- An alert is triggered for an app having a risk score of 4 or below, but the application is not installed locally, causing confusion over the alert's origin.
Ensure you have administrative access to your Microsoft Defender portal to review application discovery details, alert timestamps, and user activity logs.
Investigate Alert Details and App Discovery Sources
Review the alert properties to determine if the trigger was caused by historical data, cloud connections, or a false positive rather than a local installation.
Defender for Cloud Apps monitors cloud connections and network traffic, not just local installations. Alerts often reflect cloud applications, historical discovery data, or stale logs rather than an active desktop app.
Log in to the Microsoft Defender portal with administrator credentials and navigate to the Cloud Apps section.
Open the Alerts queue and select the specific 'New Risky App' alert to view its detailed properties and risk score.
Check the discovery source, recent activity logs, and timestamps. Look for indications that the alert stems from a cloud-connected service or stale historical data rather than a locally installed app.
If the investigation confirms the app was previously uninstalled or is a recognized cloud connection false positive, mark the alert accordingly to clear it from the queue.
Perform a Local System Security Scan
Run a thorough scan on the endpoint device to ensure no remnants of the risky application exist locally.
Secure Your Documents with WPS Office
While managing cloud app security and policies in Microsoft Defender, consider using WPS Office for your document needs. It offers a secure, lightweight, and highly compatible alternative to Microsoft Office, keeping your workflow safe and efficient.
Frequently Asked Questions
Why do I get a New Risky App alert for an app I don't have installed?
Defender for Cloud Apps monitors network traffic and cloud connections, not just local installations. The alert may be triggered by historical discovery data, cloud service connections, or a previously installed app that has since been removed.
How is the risk score calculated in Defender for Cloud Apps?
The risk score evaluates several criteria, including the application's reputation, requested permissions, behavioral patterns, vendor reliability, and overall category. A lower score indicates higher risk.
Can I adjust the threshold for New Risky App alerts?
Yes, administrators can customize the New Risky Apps policy in the Microsoft Defender portal to trigger at different risk score thresholds (e.g., changing it from 4 to a different value) to better suit organizational needs.
What should I do if an alert is a false positive?
If your investigation shows the application is legitimate, no longer installed, or does not pose a threat, you can dismiss the alert as a false positive within the Microsoft Defender portal and optionally adjust the app's tagging.
