Select the Approve pending action option to initiate a pending action.

Review the information, and then take one of the following steps:.

Select an item in the list to open its flyout pane.On the Incidents page, select an incident name to open its summary page.Filter on Pending action for the Automated investigation state (optional).To go directly to the Incidents page, use. In the Microsoft 365 Defender portal at, go to the Incidents page at Incidents & alerts > Incidents.Investigation and remediation investigations queue.Investigation itself (accessed via Incident or from an alert).There are four different ways to find and take auto investigation actions: For the duplicate approved cluster investigations, you won't see action details in the action center side panel. This behavior doesn't remove duplicate investigations or investigation evidence - it simply de-duplicates approved actions to improve remediation processing speed. If the same investigation cluster is already approved in the previous hour, new duplicate remediation will not be processed again. We've added additional checks for duplicate or overlapping investigations with the same clusters approved multiple times. You need to be part of Search & purge role before taking any actions. We recommend reviewing and approving any pending actions as soon as possible so that your automated investigations complete in a timely manner. These remediation actions are not taken unless and until your security operations team approves them.

Soft deleting email messages or clusters.In Microsoft Defender for Office 365, remediation actions can include: Microsoft Defender for Office 365 plan 2Īs automated investigations on email & collaboration content result in verdicts, such as Malicious or Suspicious, certain remediation actions are created.Review and manage remediation actions in Office 365

Microsoft action center