In Microsoft Defender for Cloud Apps (formerly Microsoft Cloud App Security), the impossible travel and sign-in from risky IP addresses anomaly detection policies automatically analyze user activity patterns and compare sign-in locations to detect suspicious behavior. However, when legitimate corporate IPs are not correctly identified as trusted, these policies may generate excessive false positives.
According to Microsoft's official documentation on managing IP address ranges:
"To reduce false positive alerts from trusted network locations, define your organization's known IP address ranges in the Defender for Cloud Apps portal. Tagging these as Corporate ensures that sign-ins originating from these IPs are treated as safe and excluded from anomaly detection alerts." To implement this properly:
* Add the IP addresses to the Corporate address range category (Option B) - This explicitly identifies these ranges as trusted corporate networks. Once defined, Microsoft Cloud App Security (MCAS) automatically suppresses anomaly alerts (like impossible travel or risky IP alerts) from these known sources.
* Override automatic data enrichment (Option A) - Automatic data enrichment uses Microsoft's threat intelligence and geolocation services to classify IPs. When you override it, the system respects your manual classification (Corporate, VPN, Risky, etc.) rather than reclassifying based on Microsoft's enrichment data. This ensures that your defined corporate IPs remain categorized correctly, avoiding repeated alerting on known legitimate sign-ins.
The other options are not appropriate:
* C. Increase sensitivity level would actually make alerts even more frequent rather than reduce them.
* D. Add IPs to "other" category does not stop alerts; only the Corporate category suppresses impossible travel alerts.
* E. Activity policy exclusion is not used for anomaly detection tuning; it applies to specific custom activity conditions.
Therefore, the correct configuration to suppress legitimate corporate alerts and follow best practice for false positive reduction is to override automatic data enrichment (A) and add corporate IPs to the Corporate address range category (B).