Microsoft Defender for Office 365: Auto-remediation of malicious similarity clusters in AIR
Microsoft Defender for Office 365 expands AIR auto-remediation to malicious similarity clusters, automating approval of remediation actions without manual intervention. Rolling out worldwide mid to late December 2025, this feature reduces SOC workload and speeds threat response. It’s off by default and can be enabled in the Defender portal.


HANDS ON tek
M365 Admin









