Microsoft Defender for Cloud Apps is replacing the legacy “Activity performed by terminated user” alert with a dynamic detection model called "Activity by a deprovisioned user (preview)" starting late June 2026. This improves detection accuracy, adapts to threats, requires no manual setup, and may change alert behavior over time.
Applies to: Microsoft Defender XDR
Source: mc.merill.net — data via Merill Fernando's open archive (MIT).