Microsoft Defender for Office 365: Auto-Remediation of Malicious Similarity Clusters in AIR

We are expanding the auto-remediation capabilities in Automated Investigations and Response (AIR) to fully automate the remediation of malicious similarity clusters. Earlier this year, we introduced auto-remediation for malicious URL and file clusters. Building on that foundation, this enhancement enables AIR to automatically approve all pending remediation actions it generates—eliminating the need for manual intervention and streamlining the response process for SOC teams. This advancement significantly reduces response time and operational overhead, allowing security teams to focus on higher-priority threats.

Added to roadmap: 3 sep 2025 | Last modified: 24 feb 2026

What changed in Microsoft 365 this week? →