Get started with app threat detection and remediation

App governance generates alerts using various mechanisms. Threat detection alerts use built-in, machine-learning-driven detection rules to find malicious app attributes and activities. Policy-based alerts are triggered either by predefined policies or user-defined policies.

To view the latest incidents associated with these alerts, go to the App governance > Overview tab in Microsoft 365 Defender.

For example:

Screenshot of the App governance > Overview tab with the Latest alerts section highlighted.

On the Overview tab, the Latest alerts section lists the most recent alerts. You can use these recent alerts to quickly see the current app alert activity for your tenant.

To see all of the alerts, select the Alerts tab.

Alerts page

App governance alerts are now listed with all other Microsoft 365 Defender alerts. To find them, filter for "App governance" as the service source.

For example:

Screenshot of the app governance alerts filtered in the Microsoft 365 Defender alerts.

Next step

Monitor and respond to apps with unusual data usage