HANDS ON SharePoint
HANDS ON Teams
HANDS ON Lists
HANDS ON tek
M365 Admin
Microsoft Defender for Office 365: Auto-Remediation of Malicious Similarity Clusters in AIR
We are expanding the auto-remediation capabilities in Automated Investigations and Response (AIR) to fully automate the remediation of malicious similarity clusters. Earlier this year, we introduced auto-remediation for malicious URL and file clusters. Building on that foundation, this enhancement enables AIR to automatically approve all pending remediation actions it generates—eliminating the need for manual intervention and streamlining the response process for SOC teams. This advancement significantly reduces response time and operational overhead, allowing security teams to focus on higher-priority threats.
| Product | Microsoft Defender for Office 365 |
|---|---|
| Release phase | General Availability |
| Release date | December CY2025 |
| Platform | Web |
| Cloud Instance | Worldwide (Standard Multi-Tenant) |
| Created | 2025-09-03 |
| Roadmap ID | 502528 |
| Roadmap Link | https://www.microsoft.com/microsoft-365/roadmap?id=502528 |
