Microsoft Defender for Cloud Apps
Cloud and workloadsHunt for threats in app activities | Microsoft Defender for Cloud Apps
In brief
The documentation now states that queries return up to 1,000 results by default and can be edited to return up to 100,000 rows. Results exceeding 64 MB may be partial and trigger a notification; these limits do not apply to app governance.
What Defender admins need to know
When investigating suspicious app activity, administrators should check for partial-result notifications and account for possible delays in app governance data.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Hunt for threats in app activities
Apps can be a valuable entry point for attackers, so we recommend monitoring anomalies and suspicious behaviors that use apps. While investigating an app governance alert or reviewing the app behavior in the environment, it becomes important to quickly get visibility into details of activities done by such suspicious apps and take remediation actions to protect assets in your organization.
Using app governance and advanced hunting capabilities, you can get complete visibility into activities done by the apps and the resources itthe app has accessed.
This article describes how you can simplify app-based threat hunting using app governance in Microsoft Defender for Cloud Apps.
App governance and advanced hunting process data separately. Any problems encountered by either solution during processing can result in a discrepancy.
App governance data processing can take several hours longer to complete. Because of this delay,
itapp governance data might not cover recent app activity that is available on Advanced Hunting.The
provided Advancedadvanced hunting queriesare setreturn up toshow only 1k results. While you1,000 results by default. You can edit the queries to return up to 100,000 rows, the advanced hunting limit. If the results exceed 64 MB, advanced hunting returns partial results and displays aquery to show more results, Advanced Hunting will still apply a maximum limit of 10k results. App governance doesnnotification. These limits don'thave this limit.apply to app governance.
Next steps
Investigate and remediate risky OAuth appsLearn how to investigate and take action on suspicious OAuth apps in your environment:
@@ -1,17 +1,19 @@ --- title: Hunt for threats in app activities | Microsoft Defender for Cloud Apps-ms.date: 08/18/2025+ms.date: 08/07/2026 ms.topic: how-to description: Learn how app governance in Microsoft Defender for Cloud Apps helps you hunt for resources accessed and activities carried out by apps in your environment. ms.reviewer: shragar-ms.custom: sfi-image-nochange+ms.custom: sfi-image-nochange, msecd-doc-authoring-1015+ai-usage: ai-assisted+#customer intent: As a security analyst, I want to hunt for suspicious app activities and accessed resources so that I can investigate and remediate risky apps. --- # Hunt for threats in app activities Apps can be a valuable entry point for attackers, so we recommend monitoring anomalies and suspicious behaviors that use apps. While investigating an app governance alert or reviewing the app behavior in the environment, it becomes important to quickly get visibility into details of activities done by such suspicious apps and take remediation actions to protect assets in your organization. -Using app governance and advanced hunting capabilities, you can get complete visibility into activities done by the apps and the resources it has accessed.+Using app governance and advanced hunting capabilities, you can get complete visibility into activities done by the apps and the resources the app has accessed. This article describes how you can simplify app-based threat hunting using app governance in Microsoft Defender for Cloud Apps. @@ -70,10 +72,12 @@ When using the **Advanced hunting** page to investigate data from app governance - App governance and advanced hunting process data separately. Any problems encountered by either solution during processing can result in a discrepancy. -- App governance data processing can take several hours longer to complete. Because of this delay, it might not cover recent app activity that is available on Advanced Hunting.+- App governance data processing can take several hours longer to complete. Because of this delay, app governance data might not cover recent app activity that is available on Advanced Hunting. -- The provided Advanced hunting queries are set to show only 1k results. While you can edit a query to show more results, Advanced Hunting will still apply a maximum limit of 10k results. App governance doesn't have this limit.+- The advanced hunting queries return up to 1,000 results by default. You can edit the queries to return up to 100,000 rows, the advanced hunting limit. If the results exceed 64 MB, advanced hunting returns partial results and displays a notification. These limits don't apply to app governance. ## Next steps -[Investigate and remediate risky OAuth apps](investigate-risky-oauth.md)+Learn how to investigate and take action on suspicious OAuth apps in your environment:++- [Investigate and remediate risky OAuth apps](investigate-risky-oauth.md)