Small IT teams cannot investigate every phishing report and every quarantined file by hand. Automated investigation and response in Defender exists so that the routine cleanup happens without you, and your attention goes to the incidents that need a human decision. The catch is that the feature has changed in 2026, and many tenants are still configured for how it worked two years ago. This post explains what automation does today, what changed for endpoints, and how to set it up so Defender cleans up low-risk alerts safely.
What automated investigation and response does
Automated investigation and response, usually shortened to AIR, mimics the steps an analyst would take after an alert. It examines the alert, gathers related evidence (other emails from the same sender, other users who clicked the same link, other devices with the same file), reaches a verdict on each piece of evidence, and then either takes a remediation action or queues one for approval.
Typical remediation actions include:
Soft-deleting malicious email messages from every mailbox that received them
Blocking a malicious URL or sender
Quarantining a file or stopping a process on a device
Flagging a user whose account shows signs of compromise
Every action, automatic or approved, is recorded in the Action center at https://security.microsoft.com/action-center, on the Pending and History tabs. Many actions can be undone from History if a verdict turns out to be wrong.
What changed on September 1, 2026
Microsoft has retired AIR as a separate investigation experience for Microsoft Defender for Endpoint. As of September 1, 2026, endpoint AIR no longer appears as its own investigation and cannot be triggered manually. The detection and remediation logic it used is now part of the default Microsoft Defender Antivirus protection stack and runs automatically. For an on-demand look at a device, Microsoft now points you to a full antivirus scan.
Two practical consequences for mid-size firms:
Defender Antivirus health matters more than ever. Endpoint remediation depends on Defender Antivirus running, with real-time protection on. If a third-party antivirus has pushed Defender into a disabled state, or a device has tamper protection off and someone has switched features off, the automatic cleanup will not happen.
The email side is unchanged. AIR in Microsoft Defender for Office 365 remains available. Email investigations, user-reported phishing playbooks and compromised-user investigations still run and still feed the Action center.
If your runbooks or MSP contract still describe “approving endpoint investigations” as a daily task, update them. The work has shifted to keeping antivirus healthy and reviewing what the platform has already done.
Licensing: who gets which automation
Capability
Business Premium
Microsoft 365 E5
Automatic endpoint remediation via Defender Antivirus
Yes (Defender for Business)
Yes (Defender for Endpoint Plan 2)
Email AIR playbooks
No (Defender for Office 365 Plan 1)
Yes (Defender for Office 365 Plan 2)
Automatic attack disruption
Limited by data sources available
Yes, across endpoints, identity and email
Action center
Yes
Yes
Defender for Office 365 Plan 2 can also be bought as an add-on to Business Premium, which is often the cheapest way to get email AIR without a full move to E5. If you want to see how the numbers compare for your headcount, try the Microsoft 365 cost calculator.
Setting it up so cleanup actually happens
The goal is simple: let Defender take high-confidence actions without waiting for you, and keep human approval only for actions with real business impact.
On endpoints
Confirm every device is onboarded and shows Defender Antivirus in Active mode, not passive or disabled. In Intune, check Endpoint security > Antivirus reports.
Turn on tamper protection tenant-wide so users and malware cannot switch protection off.
If you use Defender for Endpoint with device groups, set the automation level to Full – remediate threats automatically. Microsoft recommends full automation, and Defender for Business uses it by default.
Enable cloud-delivered protection and automatic sample submission, which improve verdict quality.
On email (Defender for Office 365 Plan 2)
Make sure the user-reported message settings send reports to Microsoft and to your reporting mailbox, so reported phish triggers an investigation.
Check that the default alert policies that trigger AIR are on, such as the ones for user-reported phish and emails removed after delivery.
Review the Action center Pending tab daily. Email remediation actions such as soft-deleting messages wait for approval by design.
Keep Zero-hour auto purge (ZAP) enabled. Several incident types in the queue exist only to tell you ZAP was off.
Automatic attack disruption: the safety net above AIR
AIR handles routine cleanup. Automatic attack disruption handles the emergencies. When Defender sees a high-confidence pattern of ransomware or business email compromise in progress, it can contain the assets the attacker is using, for example by disabling a compromised user or containing a device, before a human has even opened the incident.
Disruption actions show up with an Attack Disruption tag in the incident queue and a yellow banner on the incident page. They are also recorded in the Action center, where you can release a contained user or device once the threat is gone. Your job is to review those actions quickly and decide when it is safe to restore access.
What still needs a human
Automation is very good at deleting a phishing email from 40 mailboxes. It is not good at deciding whether the finance director’s account should be disabled during month-end close. Keep human review for:
Any action against a privileged or executive account
Releasing devices or users from containment
Incidents involving data leaving the organization
Repeated false positives, which need tuning rather than repeated approval
A useful rule of thumb: if undoing the action would be easy and the evidence is strong, let automation do it. If the action would stop someone from working or the evidence is mixed, approve it yourself.
Is automated investigation and response in Defender going away?
Only the separate endpoint investigation experience in Defender for Endpoint was retired on September 1, 2026, and its remediation logic now runs inside Defender Antivirus automatically. AIR for Defender for Office 365 remains available for email threats.
Does Microsoft 365 Business Premium include email AIR?
No. Business Premium includes Defender for Office 365 Plan 1. Email AIR playbooks require Plan 2, which comes with E5 or can be added to Business Premium as an add-on.
Is full automation safe for a small business?
For endpoint remediation, yes. Microsoft recommends full automation, actions are logged in the Action center and many can be undone. Keep manual approval for actions that would lock out key people.
Want to know whether Defender is actually cleaning up after itself in your tenant? Start with a free Microsoft 365 security assessment and we will check antivirus health, automation settings and your Action center history.
Small IT teams cannot investigate every phishing report and every quarantined file by hand. Automated investigation and response in Defender exists so that the routine cleanup happens without you, and your attention goes to the incidents that need a human decision. The catch is that the feature has changed in 2026, and many tenants are still configured for how it worked two years ago. This post explains what automation does today, what changed for endpoints, and how to set it up so Defender cleans up low-risk alerts safely.
What automated investigation and response does
Automated investigation and response, usually shortened to AIR, mimics the steps an analyst would take after an alert. It examines the alert, gathers related evidence (other emails from the same sender, other users who clicked the same link, other devices with the same file), reaches a verdict on each piece of evidence, and then either takes a remediation action or queues one for approval.
Typical remediation actions include:
Every action, automatic or approved, is recorded in the Action center at
https://security.microsoft.com/action-center, on the Pending and History tabs. Many actions can be undone from History if a verdict turns out to be wrong.What changed on September 1, 2026
Microsoft has retired AIR as a separate investigation experience for Microsoft Defender for Endpoint. As of September 1, 2026, endpoint AIR no longer appears as its own investigation and cannot be triggered manually. The detection and remediation logic it used is now part of the default Microsoft Defender Antivirus protection stack and runs automatically. For an on-demand look at a device, Microsoft now points you to a full antivirus scan.
Two practical consequences for mid-size firms:
If your runbooks or MSP contract still describe “approving endpoint investigations” as a daily task, update them. The work has shifted to keeping antivirus healthy and reviewing what the platform has already done.
Licensing: who gets which automation
Defender for Office 365 Plan 2 can also be bought as an add-on to Business Premium, which is often the cheapest way to get email AIR without a full move to E5. If you want to see how the numbers compare for your headcount, try the Microsoft 365 cost calculator.
Setting it up so cleanup actually happens
The goal is simple: let Defender take high-confidence actions without waiting for you, and keep human approval only for actions with real business impact.
On endpoints
Endpoint security > Antivirusreports.On email (Defender for Office 365 Plan 2)
Our Defender for Office 365 configuration work covers these settings, and the Defender for Endpoint engagement covers the device side.
Automatic attack disruption: the safety net above AIR
AIR handles routine cleanup. Automatic attack disruption handles the emergencies. When Defender sees a high-confidence pattern of ransomware or business email compromise in progress, it can contain the assets the attacker is using, for example by disabling a compromised user or containing a device, before a human has even opened the incident.
Disruption actions show up with an Attack Disruption tag in the incident queue and a yellow banner on the incident page. They are also recorded in the Action center, where you can release a contained user or device once the threat is gone. Your job is to review those actions quickly and decide when it is safe to restore access.
What still needs a human
Automation is very good at deleting a phishing email from 40 mailboxes. It is not good at deciding whether the finance director’s account should be disabled during month-end close. Keep human review for:
A useful rule of thumb: if undoing the action would be easy and the evidence is strong, let automation do it. If the action would stop someone from working or the evidence is mixed, approve it yourself.
For Microsoft’s own description of the change and the remaining automation levels, see Automation levels in automated investigation and remediation.
Frequently asked questions
Is automated investigation and response in Defender going away?
Only the separate endpoint investigation experience in Defender for Endpoint was retired on September 1, 2026, and its remediation logic now runs inside Defender Antivirus automatically. AIR for Defender for Office 365 remains available for email threats.
Does Microsoft 365 Business Premium include email AIR?
No. Business Premium includes Defender for Office 365 Plan 1. Email AIR playbooks require Plan 2, which comes with E5 or can be added to Business Premium as an add-on.
Is full automation safe for a small business?
For endpoint remediation, yes. Microsoft recommends full automation, actions are logged in the Action center and many can be undone. Keep manual approval for actions that would lock out key people.
Want to know whether Defender is actually cleaning up after itself in your tenant? Start with a free Microsoft 365 security assessment and we will check antivirus health, automation settings and your Action center history.