Explanation:
Set the sensitivity level of the impossible travel alert policies to: Low To reduce the amount of false positive alerts: Add IP address ranges In Microsoft Defender for Cloud Apps (formerly Microsoft Cloud App Security), the impossible travel alert policy detects when a user signs in from two geographically distant locations within a timeframe that would make physical travel between them impossible. This is an important indicator of potential account compromise but can also generate false positives if not tuned properly.
* Setting Sensitivity Level to Low:Microsoft Defender for Cloud Apps allows tuning of the Impossible travel policy sensitivity between Low, Medium, and High.
* High sensitivity increases detection but also raises the likelihood of false positives.
* Medium offers a balance.
* Low reduces the number of alerts by limiting detections to only the most obvious and high- confidence anomalies.To meet operational requirements that minimize alert noise and false positives, the sensitivity should be set to Low.
* Reducing False Positives - Add IP Address Ranges:According to Microsoft's official Defender for Cloud Apps policy tuning guidance, the main way to reduce false positives in impossible travel alerts is by adding trusted IP address ranges (e.g., office networks, VPN exit nodes, proxy gateways) to the trusted IPs list.This ensures that logins from corporate or known network ranges are not flagged as anomalous, thereby significantly reducing false alerts.
Other options, like enabling or disabling leaked credential detection, are unrelated to the impossible travel anomaly and affect credential theft alerts instead.
Therefore, the verified correct configuration is:
# Sensitivity level: Low
# Reduce false positives by: Add IP address ranges