Forum Discussion
How does Defender detect file version limit default changes?
Hi all, I am currently reviewing a historic article that mentions a Cloud Ransomware attack where attackers can change the default number of file versions saved by default. They change this from ...
Hi akl472!
To find the current file version limit settings, you can check the OneDrive or SharePoint admin centers under the storage settings for versioning. To see if the limit has been changed, you’ll need to look at the version history or activity logs. Defender doesn’t automatically alert for changes to file version limits, but you can set up a custom detection using KQL queries in Microsoft Sentinel or Defender for Endpoint. You’d need to monitor for any changes to version settings or unusual file activity.
Regards!
