Team: Huntress Managed Identity Threat Detection and Response (ITDR)
Product: Microsoft 365, Google Workspace
Environment: Unwanted Access
Summary: Huntress has updated many Managed ITDR Escalation features to reduce alert noise, eliminate false positives, and provide a precise per-identity escalation model.
In this Article
Overview of Escalation Enhancements
IP-Based Expected Rules
Onboarding Escalation Throttle
Trusted Device Suppression
Microsoft 365 Usage Location Inference
Per-Identity Escalations Default
How to Access Configuration Rules
Overview of Escalation Enhancements
To improve your experience with Huntress Managed Identity Threat Detection and Response (ITDR), we have delivered a series of updates designed to reduce alert noise and maximize detection accuracy. These changes address common sources of false positives, such as geographic shifts, VPN usage, and initial customer onboarding bursts, while ensuring critical security events are never missed.
IP-Based Expected Rules
You can now mark specific IP addresses or Classless Inter-Domain Routing (CIDR) ranges as expected at the identity, organization, or account scope. This feature allows you to explicitly define trusted corporate network spaces, such as known office egress points, cloud network address translations (NATs), or static wide area network (WAN) boundaries.
When a login matches an expected IP rule, Huntress suppresses Unexpected Country and Unexpected VPN escalations and bypasses malicious datacenter detectors. This feature supports both Microsoft 365 and Google Workspace environments. You can create these rules directly from the Respond menu within an existing escalation.
Onboarding Escalation Throttle
New organization onboarding can generate high initial alert volumes before you have time to configure expected settings. To mitigate this noise, Huntress automatically applies an onboarding safeguard.
If an organization generates five escalations for the same subtype (such as a specific country or VPN operator) within 72 hours of its first login event, escalation generation pauses for that specific organization and subtype. You will receive one pause notification through your configured email or professional services automation (PSA) workflows. The pause automatically lifts after 72 hours. This safeguard applies separately to Microsoft 365 and Google Workspace environments and requires no manual configuration. Established organizations are not affected.
Trusted Device Suppression
Logins originating from verified corporate devices, such as Microsoft Intune-compliant laptops or Microsoft Entra-joined workstations, are highly unlikely to be malicious. Huntress allows you to suppress Unexpected Country and Unexpected VPN alerts based on device trust levels.
You can manage three independent suppression toggles at the account and organization levels:
- Compliant devices
- Entra Joined / Hybrid Joined devices
- Entra Registered devices (BYOD)
Default settings depend on when your Huntress account was created:
| Toggle | Accounts created on or after July 28, 2026 | Accounts created before July 28, 2026 |
|---|---|---|
| Compliant devices | ON | OFF |
| Entra Joined / Hybrid Joined devices | ON | OFF |
| Entra Registered devices (BYOD) | OFF | OFF |
If your account was created before July 28, 2026, these toggles stay off until you enable them. See ITDR: How to Configure Trusted Device Suppression Rules.
If Huntress can’t verify the device because its data is missing or incomplete, we'll err on the side of alerting and generate an escalation as usual rather than suppress it. When an event is suppressed based on device trust, Huntress keeps an internal audit record. This particular device-based suppression feature is available only for Microsoft 365, not for Google Workspace.
Microsoft 365 Usage Location Inference
When a Microsoft 365 identity lacks a designated Microsoft Entra usage location, every login outside its inferred home environment can trigger inaccurate alerts. Huntress addresses this by automatically inferring the missing value using the tenant's default country code (defaultCountryCode).
The inferred value serves as the expected country for the identity. This process is fully automatic and requires no customer configuration. A valid usage location explicitly defined in Microsoft Entra always overrides the value inferred by Huntress.
Per-Identity Escalations Default
Historically, Huntress rolled up alerts at the organization level, grouping multiple affected identities into a single tenant-wide escalation. While this controlled volume, it occasionally caused security teams to overlook new compromises when additional identities were silently added to a previously resolved escalation.
Following the deployment of our noise-reduction features, Huntress has fully transitioned to a per-identity escalation model. Every identity receives a dedicated Huntress Escalation, notification, and corresponding PSA ticket. This ensures complete visibility into distinct account compromises without allowing new activity to be folded into old or closed events.
How to Access Configuration Rules
You can access and manage your configuration rules directly within the Huntress platform:
- Rules: How to Create an Unwanted Access Rule
- Policies: Unwanted Access Policy Creation Instructions
- How it all works: ITDR: Unwanted Access Overview