m365d-autoir-actions.md

title	description	search.appverid	ms.service	f1.keywords	ms.author	author	ms.localizationpriority	ms.date	manager	audience	ms.collection	ms.topic	ms.custom	ms.reviewer
View and manage actions in the Action center	Use the Action center to view and manage remediation actions	met150	defender-xdr	NOCSH	diannegali	diannegali	medium	11/25/2024	dansimp	ITPro	m365-security tier2	how-to	autoir admindeeplinkDEFENDER	evaldm, isco

View and manage actions in the Action center

Applies to:

• Microsoft Defender XDR

Threat protection features in Microsoft Defender XDR can result in certain remediation actions. Here are some examples:

• Automated investigations can result in remediation actions that are taken automatically or await your approval.
• Antivirus, antimalware, and other threat protection features can result in remediation actions, such as blocking a file, URL, or process, or sending an artifact to quarantine.
• Your security operations team can take remediation actions manually, such as during advanced hunting or while investigating alerts or incidents.

Note

You must have appropriate permissions to approve or reject remediation actions. For more information, see the prerequisites.

To navigate to the Action center, take one of the following steps:

• Go to https://security.microsoft.com/action-center; or
• In the Microsoft Defender portal (https://security.microsoft.com), in the Automated investigation & response card, select Approve in Action Center.

Review pending actions in the Action center

It's important to approve (or reject) pending actions as soon as possible so that your automated investigations can proceed and complete in a timely manner.

1. Go to Microsoft Defender portal and sign in.

2. In the navigation pane under Actions and submissions, choose Action center.

3. In the Action center, on the Pending tab, select an item in the list. Its flyout pane opens. Here's an example.

   :::image type="content" source="/defender/media/air-actioncenter-itemselected.png" alt-text="The options to approve or reject an action" lightbox="/defender/media/air-actioncenter-itemselected.png":::

4. Review the information in the flyout pane, and then take one of the following steps:

   • Select Open investigation page to view more details about the investigation.
   • Select Approve to initiate a pending action.
   • Select Reject to prevent a pending action from being taken.
   • Select Go hunt to go into Advanced hunting.

Tip

You now have more options to review and approve/reject a remediation action. In addition to using the Action center, you can also approve or reject a remediation action while reviewing an incident. For more information, see Approve or reject remediation actions.

Undo completed actions

If you've determined that a device or a file is not a threat, you can undo remediation actions that were taken, whether those actions were taken automatically or manually. In the Action center, on the History tab, you can undo any of the following actions:

Action source	Supported Actions
- Automated investigation - Microsoft Defender Antivirus - Manual response actions	- Isolate device - Contain device - Contain user - Restrict code execution - Quarantine a file - Remove a registry key - Stop a service - Disable a driver - Remove a scheduled task

Undo one remediation action

1. Go to the Action center (https://security.microsoft.com/action-center) and sign in.

2. On the History tab, select an action that you want to undo.

3. In the pane on the right side of the screen, select Undo.

Undo multiple remediation actions

1. Go to the Action center (https://security.microsoft.com/action-center) and sign in.

2. On the History tab, select the actions that you want to undo. Make sure to select items that have the same Action type. A flyout pane opens.

3. In the flyout pane, select Undo.

To remove a file from quarantine across multiple devices

1. Go to the Action center (https://security.microsoft.com/action-center) and sign in.

2. On the History tab, select a file that has a Quarantine file Action type.

3. In the pane on the right side of the screen, select Apply to X more instances of this file, and then select Undo.

Next steps

• View the details and results of an automated investigation
• Address false positives or false negatives [!INCLUDE Microsoft Defender XDR rebranding]