Activity performed by terminated user

[BENABRAHA]

[Could you explain how this rule works, For example should we tag a user as Terminated for this rule to work. Description is a general documention, it would be good if you could provide more info on this, Thanks!]

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 395e085f-93bd-1f3c-fe0d-7711b6d51950
• Version Independent ID: ad86d15d-41a5-9a6e-8d30-18ed9a9975f2
• Content: Create anomaly detection policies in Defender for Cloud Apps
• Content Source: CloudAppSecurityDocs/anomaly-detection-policy.md
• Service: defender-for-cloud-apps
• GitHub Login: @dcurwin
• Microsoft Alias: dacurwin

[dcurwin]

Thanks for your question. We'll investigate and get back to you.

[dcurwin]

Sorry for the delayed response. We've updated the documentation to indicate that a terminated user refers to a deleted AD account. You can't manually tag a user as terminated.