{
  "id": "CB-M365-MAIL-034",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-034",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-034.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-034.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-MAIL-034",
    "title": "Turn on automated remediation of malicious message clusters in AIR",
    "finding": {
      "title": "Messages found malicious by automated investigations wait for manual approval before removal",
      "description": "AIR identifies all copies of a malicious file or link in mailboxes, but they stay there until an analyst approves each action."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "defender-for-office-365",
      "air",
      "automated-response",
      "remediation",
      "soc"
    ],
    "applicability": {
      "requires": [
        "Microsoft Defender for Office 365 Plan 2"
      ]
    },
    "description": "In the Defender for Office 365 automation settings, automated remediation is selected for the\nmessage clusters **Similar files** and **Similar URLs** (and optionally **Multiple similar\nattributes**), with the remediation action **Soft delete**. Messages in these clusters that AIR\nfinds malicious are removed from mailboxes without waiting for SecOps approval; clusters larger\nthan 10,000 messages still wait for review.\n",
    "rationale": "After a campaign is detected, the time copies stay in mailboxes is the time users can click them.\nAutomated remediation cuts that time from hours (waiting for an analyst) to minutes, for the\nclusters where the malicious entity is well identified. Soft delete keeps the messages\nrecoverable if a verdict turns out to be wrong.\n",
    "impact": "Messages are removed from users' mailboxes without analyst review. Soft-deleted messages can be\nrestored from the Action center (**History** tab) or Threat Explorer while they are kept in the\nRecoverable Items folder; check that the deleted items retention meets legal obligations.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a\n   Security Reader.\n2. Browse to **Settings** > **Email & collaboration** > **MDO automation settings**.\n3. Check that **Similar files** and **Similar URLs** are selected under **Message clusters**, and\n   that **Soft delete** is the remediation action.\n4. There is no read-only PowerShell cmdlet for this page.\n5. Fail if neither **Similar files** nor **Similar URLs** is selected.\n"
    },
    "remediation": {
      "manual": "1. In the Defender portal, browse to **Settings** > **Email & collaboration** > **MDO automation\n   settings** (Security Administrator).\n2. Select **Similar files** and **Similar URLs** (and **Multiple similar attributes** if the SOC\n   agrees), keep **Soft delete**, and select **Save**.\n3. Check the results in the **Action center** > **History** tab with the **Decided by** filter set\n   to **Automation**.\n",
      "rollback": "Clear the cluster types on the **Automation settings** page; actions go back to pending approval.\n"
    },
    "references": [
      {
        "title": "Automated remediation in AIR",
        "url": "https://learn.microsoft.com/defender-office-365/air-auto-remediation",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Automated investigation and response (AIR) in Microsoft Defender for Office 365",
        "url": "https://learn.microsoft.com/defender-office-365/air-about",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IR-4(1)",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1566"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-MAIL-024",
        "type": "related"
      },
      {
        "id": "CB-M365-MAIL-033",
        "type": "related"
      },
      {
        "id": "CB-M365-AUDIT-002",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}