Daily Defender News
Aboutmerill.net
Microsoft Sentinel
Cloud and workloads

False Positives

4 September 2026Doc update+10 / −9 lines

In brief

The page now defines service principals, renames the exceptions section to focus on analytics rule queries, adds a section anchor, and clarifies references to Kusto documentation and automation-rule procedures.

What Defender admins need to know

Administrators can use clearer terminology and navigation when configuring or reviewing false-positive exceptions. No action is required.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Common scenarios include:

  • Normal activities by certain users, usually service principals,principals (automated identities used by applications and services), show a pattern that seems suspicious.
  • Intentional security scanning activity coming from known IP addresses is detected as malicious.
  • A rule that excludes private IP addresses should also exclude some internal IP addresses that aren't private.

Add exceptions with automation rules (Azure portal only)

ThisThe following procedure describes how to add an automation rule when you see a false positive incident. This procedure is supported in the Azure portal only.

If Microsoft Sentinel is onboarded to the Defender portal, create automation rules from scratch based on the details of your incident. For more information, see Automate threat response in Microsoft Sentinel with automation rules.

  1. Select Apply to activate the exception.

Add exceptions by modifying analytics rulesrule queries

Another option for implementingYou can also implement exceptions is to modifyby modifying the analytics rule query. You can include exceptions directly in the rule, or preferably, when possible, use a reference to a watchlist. You can then manage the exception list in the watchlist.

Modify the query

For detailed instructions on using the Analytics Rules Wizard to create and edit analytics rules, see Create custom analytics rules to detect threats.

To edit existing analytics rules, select Automation from the Microsoft Sentinel left navigation menu. Select the rule you want to edit, and then select Edit at lower right to open the Analytics Rules Wizard.

For detailed instructions on using the Analytics Rules Wizard to create and edit analytics rules, see Create custom analytics rules to detect threats.

To implement an exception in a typical rule preamble, you can add a condition like where IPAddress !in ('<ip addresses>') near the beginning of the rule query. This line excludes specific IP addresses from the rule.

let subnets = _GetWatchlist('subnetallowlist');

SeeFor more information onabout the following itemsKusto operators and functions used in the precedingexception query examples, insee the Kusto documentation: