# How does automated investigation and response (AIR) work in Microsoft 365?

URL: https://iblockspam.com/blog/microsoft-365-automated-investigation-response
Last updated: 2026-10-10
Published: 2026-10-10
Topic: Running email day to day
Author: iBlockSpam Team

> How AIR in Defender for Office 365 Plan 2 works: which alerts trigger it, what the playbooks check, approving pending actions in the Action center, and limits.

## Short answer

Automated investigation and response (AIR) is a Defender for Office 365 Plan 2 feature. Alerts such as a user-reported phish, a malicious URL click or a ZAP removal start a playbook that looks for similar messages, clicks and affected users. It then queues remediation actions, such as soft-deleting a message cluster, for an admin to approve in the Action center.

A security team of one can't read every user-reported email, check who else got it and hunt for clicks before lunch. Automated investigation and response (AIR) does that first pass for you in Microsoft 365. This guide explains what triggers it, what it checks, how approvals work, and whether it's worth it for a small team.

## What is automated investigation and response?

AIR is part of Microsoft Defender for Office 365 Plan 2, included in subscriptions such as Microsoft 365 E5 or bought as an add-on. Microsoft says AIR "triages high-impact, high-volume alerts by completing organization-level investigations" and, "when AIR identifies threats, it queues threat remediation actions for SecOps personnel to approve" ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/air-about)).

In plain terms, an alert fires, a playbook gathers evidence, and you get a short list of recommended fixes to approve or reject. Plan 1 tenants, including Microsoft 365 Business Premium, don't get AIR. See [Defender for Office 365 Plan 1 vs Plan 2](https://iblockspam.com/blog/defender-for-office-365-plan-1-vs-plan-2) for what each plan includes.

AIR also needs the unified audit log. Microsoft notes that AIR "requires that audit logging is turned on (it's on by default)." Our guide to the [Microsoft 365 audit log](https://iblockspam.com/blog/microsoft-365-audit-log-email-investigation) shows how to check.

## What triggers an automated investigation?

There are two ways in ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/air-about)):

1. **An alert designed to start AIR.** Microsoft lists suspicious email (the message, an attachment, a URL or a compromised account), [zero-hour auto purge](https://iblockspam.com/blog/microsoft-365-zero-hour-auto-purge-zap), user submissions, user click alerts and suspicious mailbox behavior.
2. **An admin starts one manually**, with **Take action** in [Threat Explorer](https://iblockspam.com/blog/microsoft-365-threat-explorer-real-time-detections), advanced hunting, a custom detection, the email entity page or the email summary panel.

These are the main default alert policies that Microsoft marks with **Automated investigation: Yes** in its [alert policy reference](https://learn.microsoft.com/en-us/defender-xdr/alert-policies):

| Alert policy | When it fires |
|---|---|
| Email reported by user as malware or phish | A user reports a message with the Report button or add-ins |
| A potentially malicious URL click was detected | A user protected by Safe Links clicks a link later found to be malicious |
| A user clicked through to a potentially malicious URL | A user overrides a Safe Links warning page |
| Email messages containing malicious URL removed after delivery | ZAP removes delivered messages with a malicious URL |
| Email messages containing malicious file removed after delivery | ZAP removes delivered messages with a malicious file |
| Email messages from a campaign removed after delivery | ZAP removes delivered messages that belong to a campaign |
| Messages containing malicious entity not removed after delivery | ZAP tried to remove a malicious message and failed |
| Suspicious email sending patterns detected | A user sends suspicious mail and is at risk of being restricted |

Microsoft adds a warning: AIR isn't triggered when "these alerts are disabled" or "were replaced by custom alerts." If you've tuned alert policies, check that the ones above are still on. Our guide to [Microsoft 365 alert policies for email](https://iblockspam.com/blog/microsoft-365-alert-policies-email) covers that review.

## What does an investigation actually check?

Microsoft's example is a user reporting a phish with the built-in Report button. That fires the **Email reported by user as malware or phish** alert, which "automatically launches the investigation playbook" ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/air-examples)). The playbook looks at:

- The threat type, who sent the message and the sending infrastructure.
- Whether other copies were delivered or blocked.
- Similar messages across the tenant, found by email clustering, and their verdicts.
- Whether the message belongs to a known campaign.
- Whether any user clicked a malicious link.

Microsoft says the playbook "evaluates and automatically resolves submissions where no action is needed (which frequently happens on user reported messages)." For the rest, it lists recommended actions on the message and its related entities: attachments, URLs and recipients.

That auto-resolution is where most of the time saving comes from. Many user reports are newsletters or harmless mail. AIR closes those without anyone reading them, and you can [email users the result](https://iblockspam.com/blog/microsoft-365-report-message-user-reported-settings) automatically.

## What actions can AIR recommend?

Microsoft's [remediation actions table](https://learn.microsoft.com/en-us/defender-office-365/air-remediation-actions) covers email threats and user risks:

| Finding | Recommended action |
|---|---|
| Malware in email | Soft delete the email or cluster |
| Malicious URL detected by Safe Links | Soft delete the email or cluster, and block the URL at time of click |
| Phishing email | Soft delete the email or cluster |
| Phish delivered, then removed by ZAP | Soft delete the email or cluster |
| External forwarding (SMTP forwarding, inbox rules or mail flow rules) | Remove the forwarding rule or configuration |
| Email delegation set up on an account | Remove delegations |
| User clicked a malicious URL | No pending action; block the URL at time of click and investigate the user |
| Volume anomaly or anomalous sending | No pending action; review manually |

Two points stand out. First, AIR soft-deletes rather than hard-deletes, so a wrong call is recoverable. Second, for the riskiest finding, a user who clicked, AIR doesn't fix anything. You still need to check whether the account is compromised, using [signs your email account is compromised](https://iblockspam.com/blog/signs-email-account-compromised) as a checklist.

Forwarding and delegation findings are useful for small teams, because they catch the persistence attackers leave behind. See [malicious inbox rules and auto-forwarding](https://iblockspam.com/blog/malicious-inbox-rules-auto-forwarding) for the manual equivalent.

## How do you approve pending actions?

Microsoft says remediation actions "aren't taken automatically. The remediation actions need approval by a member of the security operations (SecOps) team" ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/air-review-approve-pending-completed-actions)). The exception is "malicious similarity clusters, including malicious URL and file clusters", where AIR now approves its own pending actions ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/air-about)).

To approve from the Action center:

1. In the Defender portal, go to **Actions & submissions** > **Action center** > **Pending** (`https://security.microsoft.com/action-center/pending`).
2. Select an **Investigation ID** to open the investigation.
3. Open the **Pending actions** tab and select an entry (not its check box).
4. Review the evidence in the flyout: the messages, recipients and verdicts.
5. Select **Approve** to run the action or **Reject** to drop it.

You can also approve from **Email & collaboration** > **Investigations** (`https://security.microsoft.com/airinvestigation`) or from the incident's **Evidence and response** tab under **Incidents & alerts** > **Incidents**. Completed actions appear on the **History** tab of the Action center.

Timing matters. Microsoft states that "pending actions time out after awaiting approval for one week." An investigation only completes once its actions are approved or rejected, so an unwatched queue means delivered phish sitting in inboxes for days.

### Who can approve?

Starting an investigation or approving actions needs a role such as **Security Administrator** or **Security Operator** *and* the **Search and Purge** role, which by default sits only in the **Data Investigator** and **Organization Management** role groups. With Defender XDR unified RBAC, the permission is **Email & collaboration advanced actions (manage)**. Assign these to named people in advance.

## How long is AIR data kept?

According to Microsoft's [data retention table](https://learn.microsoft.com/en-us/defender-office-365/mdo-data-retention), at the time of writing (October 2026):

| Data | Retention |
|---|---|
| AIR investigation metadata | 60 days |
| AIR email metadata | 30 days |
| Action center | 180 days |
| Incidents | 30 days |

Export investigation details you might need later, for example after a payment fraud.

## Is AIR worth it for a small team?

AIR helps most where volume beats people. Consider it when:

- **Users report a lot of messages.** Auto-resolving harmless reports and grouping the real ones saves hours a week.
- **You have Plan 2 already**, through E5 or an add-on. Then the only cost is a daily look at the Pending tab.
- **Your responder is part-time.** AIR does the "who else got this?" search before anyone opens the portal.

It helps less when:

- **Nobody owns the queue.** Pending actions expire after a week. An unwatched AIR adds alerts without removing threats.
- **You're on Plan 1.** Upgrading only for AIR rarely pays off for a handful of mailboxes. Plan 1 plus a good reporting habit and [quarantine reviews](https://iblockspam.com/blog/release-quarantined-email-microsoft-365) covers most of the gap.
- **Most threats are stopped before delivery.** AIR works after the fact. Fewer phish in inboxes means fewer investigations.

A simple routine for a small Plan 2 tenant:

1. Check **Action center** > **Pending** every working day.
2. Approve soft deletes for confirmed phish and malware clusters.
3. For any "user clicked" finding, start your compromised-account checks the same day.
4. Review **History** weekly to spot repeat senders worth blocking.
5. Once a quarter, confirm the triggering alert policies are still turned on.

## Next steps

- Confirm you have Plan 2: **Explorer** appears under **Email & collaboration** in the Defender portal.
- Assign Search and Purge to the people who will approve actions, and add a daily Action center check to someone's calendar.
- Make sure the built-in Report button is on, since user reports are the most common trigger.
- Cut the volume AIR has to clean up. iBlockSpam filters spam, phishing and malware at the MX before mail reaches Microsoft 365; see the [Microsoft 365 platform guide](https://iblockspam.com/platforms/microsoft-365).

Browse our other [email operations guides](https://iblockspam.com/blog/topic/operations).

## Frequently asked questions

### Does AIR delete emails automatically without approval?

Mostly no. Microsoft says remediation actions such as soft-deleting messages or turning off external forwarding need approval by a member of the security team. The exception is malicious similarity clusters, including malicious URL and file clusters, where AIR now approves the pending remediation actions it generates automatically to speed up cleanup.

### How long do AIR pending actions wait for approval?

One week. Microsoft states that pending actions time out after awaiting approval for one week. Because the investigation only completes once its actions are approved or rejected, Microsoft recommends reviewing the Pending tab of the Action center as soon as possible. A daily check is a sensible habit for small teams.

### Which license includes automated investigation and response?

Defender for Office 365 Plan 2, either as an add-on or inside subscriptions such as Microsoft 365 E5. Plan 1, which comes with Microsoft 365 Business Premium, doesn't include AIR. AIR also needs the unified audit log turned on, which Microsoft says is the default for organizations.

### What starts an automated investigation in Defender for Office 365?

Specific alert policies, such as Email reported by user as malware or phish, A potentially malicious URL click was detected, and the ZAP alerts for messages removed after delivery. An admin can also start one from Threat Explorer with Take action. If the triggering alert is turned off or replaced with a custom alert, AIR doesn't run.

## Sources

- [Microsoft Learn: Automated investigation and response (AIR) in Microsoft Defender for Office 365](https://learn.microsoft.com/en-us/defender-office-365/air-about)
- [Microsoft Learn: Review and manage remediation actions in AIR](https://learn.microsoft.com/en-us/defender-office-365/air-review-approve-pending-completed-actions)
- [Microsoft Learn: Remediation actions from AIR](https://learn.microsoft.com/en-us/defender-office-365/air-remediation-actions)
- [Microsoft Learn: Automated investigation and response examples](https://learn.microsoft.com/en-us/defender-office-365/air-examples)
- [Microsoft Learn: Alert policies in the Microsoft Defender portal](https://learn.microsoft.com/en-us/defender-xdr/alert-policies)
- [Microsoft Learn: Microsoft Defender for Office 365 data retention](https://learn.microsoft.com/en-us/defender-office-365/mdo-data-retention)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.

---

Source: iBlockSpam, https://iblockspam.com/blog/microsoft-365-automated-investigation-response (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt