Working with highly limited policy customization, such as adjusting each policy’s risk appetite score or granularity only to a specific OU or cloud environment—limitations that contribute to a high false-positive alert rate and longer median time to remediate (MTTR) because you must do triage.
Third-party tools and custom scripts to manage alerts.
Choosing between speed of delivery and security.