Turn on automated remediation of malicious message clusters in AIR

Description

In the Defender for Office 365 automation settings, automated remediation is selected for the message clusters Similar files and Similar URLs (and optionally Multiple similar attributes), with the remediation action Soft delete. Messages in these clusters that AIR finds malicious are removed from mailboxes without waiting for SecOps approval; clusters larger than 10,000 messages still wait for review.

Rationale

After a campaign is detected, the time copies stay in mailboxes is the time users can click them. Automated remediation cuts that time from hours (waiting for an analyst) to minutes, for the clusters where the malicious entity is well identified. Soft delete keeps the messages recoverable if a verdict turns out to be wrong.

Impact

Messages are removed from users' mailboxes without analyst review. Soft-deleted messages can be restored from the Action center (History tab) or Threat Explorer while they are kept in the Recoverable Items folder; check that the deleted items retention meets legal obligations.

Applies when

Requires: Microsoft Defender for Office 365 Plan 2

Audit

1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a Security Reader.
2. Browse to Settings > Email & collaboration > MDO automation settings.
3. Check that Similar files and Similar URLs are selected under Message clusters, and that Soft delete is the remediation action.
4. There is no read-only PowerShell cmdlet for this page.
5. Fail if neither Similar files nor Similar URLs is selected.

Remediation

1. In the Defender portal, browse to Settings > Email & collaboration > MDO automation settings (Security Administrator).
2. Select Similar files and Similar URLs (and Multiple similar attributes if the SOC agrees), keep Soft delete, and select Save.
3. Check the results in the Action center > History tab with the Decided by filter set to Automation.

Rollback

Clear the cluster types on the Automation settings page; actions go back to pending approval.

References

• Automated remediation in AIR Microsoft, vendor-doc, accessed 2026-10-24
• Automated investigation and response (AIR) in Microsoft Defender for Office 365 Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-MAIL-024 Keep zero-hour auto purge on for malware, phishing and spam
• related CB-M365-MAIL-033 Send user-reported messages to Microsoft and to a reporting mailbox
• related CB-M365-AUDIT-002 Forward Microsoft 365 security logs to the SIEM or SOC

People and lifecycle